Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Frequent Registry Modification Activity
Cortex XDR
This rule identifies processes performing a high volume of registry modifications by tracking unique registry key and value sets associated with user and process context. This behavioral pattern is often used to detect persistence mechanisms, configuration changes, or mass registry manipulation.
This rule detects obfuscation of the Windows Registry Run key paths (SOFTWARE\Microsoft\Windows\CurrentVersion\Run) through the insertion of arbitrary non-alphanumeric characters. This is a common evasion technique used to bypass simple string-based detections for persistent autostart registry entries.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
This rule monitors registry modifications targeting Windows Defender policies and Sysmon service configuration. Specifically, it tracks attempts to disable real-time protection, anti-spyware features, and service settings commonly used by adversaries to impair security monitoring and defensive tools, characteristic of defense impairment tradecraft.
Detects persistence mechanisms used by the Mustang Panda threat actor (specifically the SHARDLOADER/ZOHOMURK malware variants). The rule monitors for the creation or modification of Windows Run registry keys using specific, known malicious value names (e.g., 'MediumNetMonIt', 'MicrosoftEdgeUpdateBrokerTask') or pointing to suspicious file paths located in 'C:\ProgramData\IDM\logs\' or within the 'VaultCache' folder.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
This rule detects modifications to registry keys related to the Local Security Authority (LSA) or Security Account Manager (SAM). Such modifications, indicated by Event ID 4657, can be a sign of privilege escalation attempts, credential dumping, or other malicious activities aimed at compromising system security.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
This rule detects various User Account Control (UAC) bypass techniques (such as fodhelper.exe or eventvwr.exe hijacking), registry modifications involving 'ms-settings' classes, and the use of 'Start-Process -Verb RunAs' to request administrative privileges. It also flags potentially elevated installations of OpenSSH or Tailscale, which are commonly targeted by attackers following privilege escalation.
Detects registry modifications (get, set, delete, rename) performed by the Filter Manager utility (fltMC.exe) targeting common Windows software and class registry keys. While fltMC is a legitimate Windows utility for managing filter drivers, its interaction with these specific registry hives is highly suspicious and may indicate unauthorized persistence or configuration tampering.
Detects modification or creation of registry run keys in HKLM or HKCU hives that point to suspicious paths (AppData, Temp, ProgramData, or specific SharkLoader directories) or filenames (SystemSettings.exe). This behavior is indicative of malware attempting to establish persistence.
Detects CldFlt.sys driver load activity coinciding with SyncRootManager registry modifications by non-standard processes, indicating potential RedSun exploitation of CVE-2026-41091 via the Cloud Files filter driver path. This correlation suggests an attempt to establish persistence or escalate privileges by manipulating system components related to cloud file synchronization.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects persistence from the postcss-minify-selector-parser npm typosquat Windows RAT (JFrog, Jun 2026). The Python/Nuitka implant (launched as chost.exe, a renamed python.exe running loader.py) writes an HKCU Run value named 'csshost'. Fires on a CurrentVersion\Run write where the value name is csshost OR the writing process is chost.exe.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects unexpected registry modifications (creation, deletion, or modification) performed by processes associated with 'Nearby Share' (quick_share.exe, nearby_sharing.exe). Legitimate registry activity related to Google Nearby Share or Windows native Nearby Sharing is excluded from this alert.
Detects suspicious modifications to Windows registry keys associated with logon script execution, such as 'UserInitMprLogonScript' or 'Userinit'. These locations are frequently abused by adversaries to achieve persistence by forcing the execution of malicious scripts or binaries upon user logon. The rule excludes modifications made by standard Microsoft Windows processes to reduce noise.
Detects modifications to COM object registration keys under HKEY_CURRENT_USER (HKCU) which can be used to hijack COM objects for persistence. The rule monitors for the creation or modification of InProcServer32 or LocalServer32 values, while excluding common system paths to reduce noise.
This rule detects registry interactions involving the HKCU\Software\Creeper registry key, which is associated with BeepRAT. The malware utilizes this registry path to dynamically retrieve or update its command-and-control (C2) server infrastructure, allowing the attacker to change infrastructure without modifying the embedded implant code.
Page 5 of 22