Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
833 detections
Filters
Last updated
All Time
Detection languages
279
163
137
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,872
5,155
4,866
833
Platforms
832
10
4
2
1
Products / Services
418
220
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features such as IEHarden, Data Execution Prevention (DEP), and the First Run Customize wizard.
Detects modification of the registry key that specifies the path to the screensaver binary. This can be abused by adversaries to establish persistence or elevate privileges by executing malicious code when the screensaver activates.
Detects modifications to the 'User Shell Folders' registry key, specifically targeting the 'Startup' value. This key can be manipulated by adversaries to achieve persistence by launching malicious payloads during system startup.
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
Detects applications attempting to modify the Windows Registry to disable write protection for storage devices. This activity can precede ransomware attacks or other malicious data manipulation, as observed with certain threat groups.
This rule detects modifications or additions to the 'TypedPaths' registry key, which is used by Windows Explorer to store recently typed paths in the Run dialog and File Explorer address bar. Adversaries can leverage this key for persistence by injecting malicious paths that get executed when a user interacts with these features. The rule specifically filters out modifications made by the legitimate 'explorer.exe' process to reduce false positives, focusing on non-standard applications attempting to modify this key.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry keys. Adversaries might do this to lower the default file type risk, allowing potentially malicious files (like executables, scripts, or archives) to bypass security warnings when downloaded or opened. The rule specifically looks for modifications to 'DefaultFileTypeRisk' to a value that indicates low risk (0x00006152) or additions of common executable/script file extensions to 'LowRiskFileTypes'.
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Potential adversaries accessing the microphone and webcam in an endpoint.
Detects suspicious changes to the Windows Defender configuration
Detects the Setting of Windows Defender Exclusions
Page 40 of 40