Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
833 detections
Filters
Last updated
All Time
Detection languages
279
163
137
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,872
5,155
4,866
833
Platforms
832
10
4
2
1
Products / Services
418
220
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This analytic detects modifications to the Windows registry that disable Windows Defender's file hash computation by setting the EnableFileHashComputation value to 0. This can impair Windows Defender's ability to detect and scan for malware, potentially allowing attackers to bypass security controls for undetected malware execution and persistence.
Detects the enabling of the Windows Recall feature by manipulating registry keys using `reg.exe`. This rule specifically looks for commands that either delete the `DisableAIDataAnalysis` registry value or set it to `0` within the `Microsoft\Windows\WindowsAI` path, indicating an attempt to activate the Recall feature. This activity is often associated with post-exploitation discovery and collection by adversaries.
This rule detects attempts to modify the "ChannelAccess" registry key, which controls access permissions for Windows event channels. Adversaries may tamper with these permissions to prevent security tools or analysts from accessing event logs, thereby hindering detection and forensic analysis. The rule specifically looks for modifications to the 'ChannelAccess' key within the 'WINEVT\Channels' registry path and identifies specific Security Descriptor Definition Language (SDDL) strings that grant 'GENERIC ALL' or 'GENERIC WRITE' permissions to local administrators, local system, or built-in administrators. This activity is often a precursor to clearing event logs or otherwise impairing defenses.
ServiceDLL Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence by adversaries to execute malicious payloads as part of persistence or privilege escalation. The rule specifically looks for modifications to the ServiceDll registry key within the Windows Services hive, while filtering out common legitimate modifications related to printing, domain controllers, and system updates.
This rule detects attempts to change the 'Altitude' registry value for the Sysmon driver instance. Modifying this value can prevent Sysmon from loading correctly at boot if the new altitude conflicts with other registered services, effectively disabling or impairing its monitoring capabilities. This technique is often used by adversaries to evade detection.
Detects modifications to shell context menu commands within the Windows Registry. This rule is designed to identify potential persistence mechanisms or suspicious activity where an attacker might alter the commands executed when a user interacts with files or folders via the right-click context menu. The detection specifically looks for changes in registry paths containing '\Software\Classes\', '\shell\', and '\command\', which are indicative of context menu command definitions.
Detects suspicious modifications to the SentinelOne context menu scan command in the Windows Registry. This rule specifically looks for changes made by processes other than the legitimate SentinelOne agent, indicating potential tampering or persistence mechanisms.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
Detects changes to the PowerShell execution policy in the Windows Registry to bypass signing requirements for script execution. This rule specifically looks for modifications to the 'ExecutionPolicy' registry values under PowerShell-related paths, setting them to 'Bypass' or 'Unrestricted'. It also filters out changes made by 'svchost' to reduce false positives.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could disable these warnings to run malicious Python code within spreadsheets without user notification, leveraging the new Microsoft Excel feature that allows Python execution.
This rule detects blocked attempts to modify Microsoft Defender Antivirus settings when Tamper Protection is enabled. Specifically, it looks for Event ID 5013 from the Windows Defender service, which indicates that Tamper Protection has blocked a change to Defender's configuration. The rule targets attempts to disable key features such as AntiSpyware, AntiVirus, archive scanning, network file scanning, real-time monitoring, behavior monitoring, IOAV protection, and script scanning by monitoring specific registry value paths.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects the use of 'reg.exe' to add or copy registry keys within the 'SafeBoot' path. This activity is often associated with ransomware attempting to ensure persistence or functionality in Windows Safe Mode, potentially to bypass security products that do not operate in that mode.
Detects changes to registry values related to Outlook security settings, which could indicate an attempt to modify Outlook's behavior for persistence or other malicious purposes. This rule specifically looks for modifications within the 'SOFTWARE\Microsoft\Office\<version>\Outlook\Security\' registry path.
Detects changes to the "AutodialDLL" registry key, which can be used as a persistence method to load custom DLLs via the "ws2_32" library. This technique allows an attacker to execute malicious code every time a process loads the Winsock2 library.
This rule detects registry modifications associated with the Ke3chang/TidePool malware families. Specifically, it looks for command-line arguments used to modify the 'Check_Associations', 'DisableFirstRunCustomize', and 'IEHarden' registry keys. These modifications are known to be unique to these malware families and were observed in campaigns in 2019 and 2020.
Detects suspicious changes to Windows Defender's configuration settings, which could indicate an attempt to disable or impair its protective capabilities. This rule specifically looks for modifications to registry keys related to disabling anti-spyware, removable drive scanning, network drive scanning, cloud-delivered protection (Block at First Seen), and real-time protection reporting.
Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.
Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Page 39 of 40