Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Detects modification of Winlogon registry keys for DLL persistence
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects the creation or modification of a registry run key that uses a name similar to '.NET Runtime Optimization Service' and points to a suspicious location within 'C:\ProgramData\'. This technique is often used by adversaries to establish persistence on a system by masquerading as legitimate software.
Detects modifications to Windows Registry Run keys that are indicative of Remcos RAT establishing persistence. The rule monitors for registry values being set or keys created in standard Run and Policy-based startup locations, specifically flagging entries that reference suspicious file paths (such as AppData or Temp) or contain known Remcos-related strings.
Detects the modification or creation of registry keys related to COM InprocServer32 within the HKEY_CURRENT_USER hive, specifically pointing to executable or library files residing within the user's AppData/Local directory. This technique is commonly used by adversaries for persistence by hijacking COM objects to execute malicious code when legitimate software invokes the hijacked component.
Detects a suspicious sequence where a non-Microsoft signed process running from a user-writable path (e.g., Temp, AppData) spawns a high-integrity or SYSTEM process, followed immediately by persistence activity (modifying Run keys) or the creation of suspicious services/modification of security preferences.
This rule monitors for the creation or modification of Windows Registry Run/RunOnce keys by executables residing in non-standard, user-writable directories (e.g., AppData, Temp, Downloads). It triggers when an initiating process performs this action while using masquerading names (matching common system binaries), using suspicious lure-themed naming, or when the run key value points to AppData for a file lacking version metadata, which are patterns observed in Millenium RAT activity.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
Detects the presence or activity of a known malicious Chromium-based browser extension (Perplexity AI imposter, ID: flkebkiofojicogddingbdmcmkpbplcd) through monitoring file system changes in browser directories, registry modifications, or network communication with identified command-and-control infrastructure.
Detects the Turla threat group's STOCKSTAY malware establishing persistence by creating a registry entry in the HKCU Run key. The persistence mechanism points to 'MicrosoftUpdateOneDrive.exe' located in the '%LOCALAPPDATA%\Programs\SMN\' directory.
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
Detects registry run key additions that masquerade as the legitimate .NET Runtime Optimization Service. This behavior is used by the Lorem Ipsum loader (associated with Rapid Brigantine) to establish persistence by executing a payload dropped in C:\ProgramData\ upon user login.
Detects registration of malicious time provider DLLs for SYSTEM persistence
Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.
Detects the Windows RAT from the PostCSS typosquatting campaign establishing persistence by writing a registry Run key value named 'csshost' via chost.exe. The RAT targets HKCU and HKLM CurrentVersion\Run to survive reboots.
This rule detects attempts to establish persistence for 'vds.exe' (Virtual Disk Service) by modifying the Image File Execution Options (IFEO) registry key to point its debugger to an executable located within the Windows Fonts directory. This technique is often used by adversaries to maintain access or elevate privileges, as the Fonts directory is typically writable by standard users and can be used to hide malicious executables.
Detects creation or modification of SilverFox/Sauron campaign-specific registry keys (Software\ODBDC, SOFTWARE\JDBCC, SOFTWARE\Sauron) and the 'revbs' value name used as infection state tracking markers.
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
Detects modifications to Windows Registry Run or RunOnce keys initiated by either a QEMU-based process (qemu-system) or the Windows Registry utility (reg.exe). The rule specifically targets instances where the registry value data points to common temporary directory paths, which is characteristic of the STAC4713/GOLD ENCOUNTER intrusion activity where QEMU-based virtualization is used to facilitate persistence.
Detects modifications to the 'User Shell Folders' registry key, which can be abused by adversaries to alter the location of special folders (e.g., Desktop, Documents) to point to attacker-controlled locations, potentially for persistence or data staging.
Page 6 of 22