Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
833 detections
Filters
Last updated
All Time
Detection languages
279
163
137
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,872
5,155
4,866
833
Platforms
832
10
4
2
1
Products / Services
418
220
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule detects attempts to modify Remote Desktop Protocol (RDP) related registry keys using the `reg.exe` utility. Specifically, it looks for command-line executions of `reg.exe` that add or modify values within the `CurrentControlSet\Control\Terminal Server` registry path. The rule targets modifications related to RDP licensing, concurrent sessions, WinStation configurations (like `MaxInstanceCount`, `fEnableWinStation`, `TSUserEnabled`, `TSEnabled`, `TSAppCompat`, `IdleWinStationPoolCount`, `TSAdvertise`, `AllowTSConnections`, `fSingleSessionPerUser`, `fDenyTSConnections`), which could indicate an adversary enabling or reconfiguring RDP for persistence, lateral movement, or defense evasion.
Detects attempts to modify critical service configuration registry keys (ImagePath, FailureCommand, and ServiceDll) by processes running with a 'Medium' integrity level. This activity can indicate a privilege escalation attempt where an attacker with medium integrity tries to alter service execution to gain higher privileges or establish persistence.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
Detects changes to the Windows EventLog channel permission values by monitoring modifications to the Security Descriptor Definition Language (SDDL) string in the registry. Such modifications can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify an event log channel. This action can prevent users from accessing the event log channel via Event Viewer or utilities like "Get-EventLog" or "wevtutil".
This rule detects modifications to Internet Explorer registry settings, which attackers can abuse for persistence or defense evasion. Specifically, it looks for changes within the 'Software\Microsoft\Windows\CurrentVersion\Internet Settings' registry path. Potential malicious activities include adding domains to the Trusted Sites Zone or injecting JavaScript for persistence. The rule filters out common benign modifications related to DWORD values, Office applications, cache, ZoneMap, WpadDecision paths, binary data, and changes made by 'RuntimeBroker.exe' or within 'Accepted Documents' to reduce false positives.
Detects modifications to specific autostart extensibility points (ASEPs) within the Wow6432Node Classes registry path. These registry keys are often abused by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon system startup or user logon.
Detects modifications to the 'TreatAs' registry key, which can be used for COM Hijacking. This technique allows an attacker to substitute a legitimate COM object with a malicious one, often used for persistence or privilege escalation, particularly when combined with commands like "rundll32.exe -sta". The rule includes filters for common legitimate processes that might modify this key, such as Microsoft Office components, svchost.exe, and msiexec.exe during installations or updates.
Detects modifications to a registry key which contain an IP address as data which is used by HoldingHands malware to update its C2 server IP address.
This analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private". This modification, specifically setting the 'Category' value to '1' within the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}' registry path, typically enables less restrictive firewall policies. Adversaries may perform this action to facilitate lateral movement or reduce security restrictions. While legitimate network configuration can involve this change, its occurrence outside standard IT processes or correlated with other suspicious activities (like unusual account activity, administrative privilege usage, or execution of unsigned binaries) can indicate malicious post-exploitation behavior.
The following analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private", which may indicate an adversary is preparing the environment for lateral movement or reducing firewall restrictions. Specifically, this activity involves changes to the Category value within the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} registry path. A value of 1 corresponds to a private network profile, which typically enables less restrictive firewall policies. While this action can occur during legitimate network configuration, it may also be a sign of malicious behavior when combined with other indicators such as suspicious account activity, unexpected administrative privilege usage, or execution of unsigned binaries. Monitoring for this registry modification—especially outside standard IT processes or correlated with persistence mechanisms—can help identify stealthy post-exploitation activity.
Detects modifications to the "PendingFileRenameOperations" registry key when initiated by suspicious or uncommon executable locations or by specific system utilities like `reg.exe` or `regedit.exe`. This registry key is used by Windows to stage files for renaming or deletion after a system reboot, and its manipulation can be a defense evasion technique to replace legitimate files with malicious ones or to remove forensic artifacts.
Detects registry modifications associated with the Gentlemen ransomware group. These changes are intended to weaken security controls for NTLM, Remote Desktop Protocol (RDP), and administrative access to facilitate lateral movement and persistence.
This analytic detects the modification of the Windows Registry key "Level" under Outlook Security. This allows macros to execute without warning, which could allow malicious scripts to run without notice. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
Identifies a possible malware persistence mechanism where the registry is modified to run a non-text editor application each time the user interacts with a .txt file.
Detects attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This technique is used by malware like Salat Stealer to bypass security prompts and perform administrative tasks without user approval.
Detects the PerfhLoader persistence technique used by the Lazarus Group, which involves modifying the 'SessionEnv' service to start automatically and either adding sensitive privileges or dropping a malicious DLL for phantom loading. This rule correlates events across process launches (sc.exe modifying SessionEnv service), registry modifications (adding privileges to SessionEnv service), and file creations (dropping a specific DLL for phantom loading).
Detects PowerShell commands, particularly those involving download and execution cradles (irm/iex), being written to the RunMRU registry key. This behavior is indicative of social engineering attacks like 'ClickFix' where users are tricked into pasting and running malicious commands via the Windows Run dialog.
Enable Rdp Via Registry
YARA-L
Detects a registry modification to enable Remote Desktop Protocol (RDP) by setting the 'fDenyTSConnections' value to 0. This is a common technique used by threat actors, including those deploying KawaLocker, Medusa, and Crypto24 ransomware, to enable lateral movement or establish persistence.
The following analytic detects modifications to the registry that enable RDP on a machine using a non-default port number. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" and the "PortNumber" value. This activity is significant as attackers often modify RDP settings to facilitate lateral movement and maintain remote access to compromised systems. If confirmed malicious, this could allow attackers to bypass network defenses, gain persistent access, and potentially control the compromised machine.
This analytic detects modifications in the Windows registry to enable Remote Desktop Protocol (RDP) on a targeted machine. It specifically monitors changes to the "fDenyTSConnections" registry value to "0x00000000", which indicates RDP has been enabled. This activity is significant because enabling RDP via registry is uncommon and often associated with adversaries or malware attempting to gain remote access. If confirmed malicious, this could allow attackers to remotely control the compromised host, potentially leading to further exploitation and lateral movement within the network.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
Page 33 of 40