Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
833 detections
Filters
Last updated
All Time
Detection languages
279
163
137
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,872
5,155
4,866
833
Platforms
832
10
4
2
1
Products / Services
418
220
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects potential COM hijacking used by Sednit (APT28) malware like BeardShell and SlimAgent for persistence. This involves modifying InprocServer32 registry keys to point to malicious DLLs.
Detects modifications to the 'User Shell Folders' registry key, which can be abused by adversaries to alter the location of special folders (e.g., Desktop, Documents) to point to attacker-controlled locations, potentially for persistence or data staging.
This rule detects suspicious activity related to Microsoft Distributed Transaction Coordinator (MSDTC) where the OracleOciLibPath registry value is modified, followed by msdtc.exe loading an unsigned oci.dll within a 4-hour window. This behavior can indicate an attempt to hijack the DLL loading process for persistence or privilege escalation, potentially by an attacker replacing the legitimate Oracle OCI library with a malicious one.
Detects modifications to the Image File Execution Options (IFEO) or SilentProcessExit registry keys, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries may use these mechanisms to attach debuggers or monitor programs to legitimate executables, causing malicious code to run when the target application starts or exits.
thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
Detects persistence mechanism used by Valley RAT, associated with the Silver Fox APT. The malware stores its configuration or modular plugins as REG_BINARY data in the 'HKCU\Console' registry key.
This rule detects unexpected modifications to Notepad++ updater settings in the Windows Registry. Specifically, it looks for instances where the 'updater' registry value under 'Notepad++\Settings' is set to '1' or 'true', indicating that automatic updates are enabled or forced. This could be an indicator of compromise if Notepad++ is not expected to update automatically or if the modification occurs outside of normal update cycles, potentially by an attacker attempting to maintain persistence or introduce malicious updates.
Detects the creation or modification of registry values used by the Valley RAT malware to store its configuration and modular plugins. Silver Fox operators use this mechanism for persistence and to dynamically update C2 infrastructure.
Monitoring the execution of auditpol.exe can be crutial to detect first-stage of a real attack because they will be shown as previous steps to obfuscate the next execution such a ransomware.
Detects potential malicious modification of the 'IsCredGuardEnabled' property value within the WDigest registry key to disable Credential Guard on a system. This action is often performed in conjunction with 'UseLogonCredential' to manipulate credential caching, potentially leading to credential dumping.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Detects changes to the ClickOnce trust prompt registry key to enable installations from various locations, such as the Internet. This modification can allow an attacker to bypass security prompts and execute untrusted code via ClickOnce applications.
This rule detects attempts to downgrade NetNTLM security settings by monitoring modifications to specific registry keys related to LSA (Local Security Authority) configuration. Specifically, it looks for changes to 'LmCompatibilityLevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the 'SYSTEM\ControlSet\Control\Lsa' registry path. Such modifications can weaken NTLM authentication security, potentially enabling downgrade attacks where an attacker forces a less secure authentication protocol.
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
This rule detects attempts to tamper with Sysmon's operational settings by monitoring changes to specific registry keys related to Sysmon's event publishers and channels. Specifically, it looks for modifications that disable Sysmon's 'Enabled' status (EventID 4657, NewValue 0) or attempts to delete the Sysmon operational channel (EventID 4663, AccessMask '0x10000'). This activity could indicate a threat actor trying to evade detection by disabling or muting Sysmon logging.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
This rule detects suspicious modifications to screensaver settings in the Windows Registry using `reg.exe`. Adversaries may manipulate these settings to establish persistence by executing malicious content when a user is inactive. Specifically, it looks for `reg.exe` commands that modify the `ScreenSaveActive`, `ScreenSaveTimeout`, `ScreenSaverIsSecure`, or `SCRNSAVE.EXE` registry values within `HKEY_CURRENT_USER\Control Panel\Desktop` or `HKCU\Control Panel\Desktop` with the `/f` (force) flag.
Detects modifications to specific registry keys related to NetNTLM authentication settings. These modifications can indicate an attempt to downgrade NetNTLM security, potentially enabling NetNTLM downgrade attacks. The rule specifically looks for changes to 'lmcompatibilitylevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the LSA registry path to less secure values.
Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.
Detects modifications to various autostart extensibility points (ASEPs) within the Windows Registry's CurrentVersion key. This rule specifically looks for changes to common Run, RunOnce, RunServices, ShellServiceObjectDelayLoad, and other related keys that are frequently abused for persistence and privilege escalation. The rule includes extensive filters for known legitimate software and system processes to reduce false positives.
Detects changes to the "DisableRestrictedAdmin" registry value via process creation events. This registry value controls RestrictedAdmin mode, which prevents the transmission of reusable credentials to a remote system during Remote Desktop connections, thereby mitigating credential harvesting if the remote server is compromised. This rule specifically looks for command-line arguments that indicate an attempt to modify this registry key.
Page 32 of 40