Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects the creation or modification of Windows Registry Run/RunOnce keys by processes related to the WinGet DSC (Desired State Configuration) engine. This activity may indicate an adversary attempting to establish persistence by abusing legitimate configuration management utilities to execute malicious code at user logon.
Identifies the EDR killer modifying the Image File Execution Options (IFEO) registry keys to silently attach a debugger (like systray.exe) to EDR components, effectively blinding them.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects unexpected registry modifications (creation, deletion, or modification) performed by processes associated with 'Nearby Share' (quick_share.exe, nearby_sharing.exe). Legitimate registry activity related to Google Nearby Share or Windows native Nearby Sharing is excluded from this alert.
Hunts for the TiFlux agent executing commands to modify Windows Defender or Firewall registry keys to lower security postures.
Detects suspicious modifications to Windows registry keys associated with logon script execution, such as 'UserInitMprLogonScript' or 'Userinit'. These locations are frequently abused by adversaries to achieve persistence by forcing the execution of malicious scripts or binaries upon user logon. The rule excludes modifications made by standard Microsoft Windows processes to reduce noise.
Detects the Remcos RAT establishing persistence by writing its binary path (typically under %ProgramData%\Remcos\remcos.exe) to Windows registry Run keys or Explorer Run policy keys.
Detects COM hijacking of the UnexpectedShutdownReason CLSID used by the PRISMEX dropper to establish persistence. This rule specifically looks for modifications to the InProcServer32 subkey for the CLSID {68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}.
Detects the creation of the WinSysCache registry run key designed to launch the RuntimeHost.exe component on startup, often associated with cryptojacking campaigns.
Detects modifications to Microsoft Defender configuration registry keys to disable protection features.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects modifications to the 'User Shell Folders' registry key, which can be abused by adversaries to alter the location of special folders (e.g., Desktop, Documents) to point to attacker-controlled locations, potentially for persistence or data staging.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Detects user or script launching regedit.exe with command lines targeting the specific 'Edgre' run key, which is associated with persistence mechanisms used by the XenoRAT malware.
Detects the addition of a persistence mechanism by writing a registry value named 'browser' to the Windows Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). The rule specifically looks for registry string values pointing to executables located within the user's AppData\Local directory, which is a common technique for establishing user-level persistence via masquerading as a web browser.
Detects unauthorized modification of Windows Registry keys intended to disable core administrative tools, including Task Manager, Registry Editor, Command Prompt/Run dialogs, and the Control Panel. Additionally, it identifies the creation of 'DisallowRun' entries used to block security and remediation utilities like Process Explorer, Autoruns, and System Configuration tools.
Identifies AstarionRAT establishing persistence by writing itself into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, specifically looking for an executable in an AppData path, initiated by rundll32.exe.
Detects a script process (wscript.exe or cscript.exe) creating files in a specific HP-themed directory (e.g., 'Programs\HP\Printer\Driver') and subsequently establishing persistence by creating a Run key in the registry that points to an executable within that same HP-themed path. This behavior is indicative of the Turla Kazuar VBScript dropper.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects modifications to the Windows QoS Group Policy registry hive, which can be used as a persistence mechanism for EDR throttling or other malicious purposes. This rule specifically looks for any registry events within the 'SOFTWARE\Policies\Microsoft\Windows\QoS' path.
Page 7 of 22