Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
442 detections
Filters
Last updated
All Time
Detection languages
177
95
67
56
11
Contributors
86
58
55
51
21
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
441
8
3
3
1
Products / Services
144
116
86
36
21
MITRE Techniques
343
237
197
130
121
CVEs
3
2
1
1
1
IDS Classtypes
10
IDS Protocols
10
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Targets service registration for msidiskserver or an ImagePath ending in fsdiskbit.sys. The UDM rule retains principal and target context for correlation.
Monitors for attempts to modify ClickOnce registry trust settings to suppress security prompts for unsigned packages, which can be used by attackers to install, persist, and update malware without administrative rights.
Detects AppCertDlls registry key modification for persistent DLL injection
This rule detects modifications to Windows Registry Run keys (Run, RunOnce, RunOnceEx, Policies\Run) where the new value contains common scripting interpreters like PowerShell, cmd, cscript, or wscript, and the path is not within the System32 directory. This behavior is indicative of an adversary attempting to establish persistence by ensuring their malicious script or command executes upon user login.
Detects the creation of a 'Realtek HD Audio Universal Service' run key pointing to a downloaded malware payload, as observed in Seedworm activity.
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Targets service registration for msidiskserver or an ImagePath ending in fsdiskbit.sys. The UDM rule retains principal and target context for correlation.
Detects registration of malicious port monitor DLLs via print spooler
Detects the creation or modification of the CadenceOptimizer service registry keys, indicating Vidar Turb00 persistence via a dropped secondary payload. This rule specifically looks for registry events affecting the 'CadenceOptimizer' service path.
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
Targets registry or file artefacts that install VSPMsg as an x64 print processor. The UDM rule retains principal and target context for correlation.
Targets registry or file artefacts that install VSPMsg as an x64 print processor. The UDM rule retains principal and target context for correlation.
Detects modification of file associations to hijack execution flow
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
Detects disabling of Windows Defender through registry modifications
Detects modification of registry Run keys for autostart persistence
Detects registration of malicious port monitor DLLs via print spooler
This rule detects modifications to registry keys related to the Local Security Authority (LSA) or Security Account Manager (SAM). Such modifications, indicated by Event ID 4657, can be a sign of privilege escalation attempts, credential dumping, or other malicious activities aimed at compromising system security.
This rule detects network traffic attempting to exploit a Service Registry ACL weakness remotely. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "HKLM\System\CurrentControlSet\Services" (case-insensitive) in the payload. This string is indicative of an attempt to modify or interact with Windows services via the registry, potentially leveraging weak ACLs to establish persistence or execute malicious code.
Page 9 of 22