Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Detects potential persistence activity via outlook today page.
An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application.
This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API.
This can be potentially abused as a persistence mechanism.
This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API.
This can be potentially abused as a persistence mechanism.
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll
Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings
Detect change of the user account associated with the FAX service to avoid the escalation problem.
Detects potential persistence using Appx DebugPath
Detect set DisallowRun to 1 to prevent user running specific computer program
Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
Detects when the "index" value of a scheduled task is modified from the registry
Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"
Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
Page 84 of 101