Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Detects when an attacker register a new SIP provider for persistence and defense evasion
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
This technique is abused by several malware families to hide their files from normal users.
This technique is abused by several malware families to hide their files from normal users.
BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption
Detects modification of autostart extensibility point (ASEP) in registry.
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
Detects modification of autostart extensibility point (ASEP) in registry.
Detects when the 'AllowMultipleTSSessions' value is enabled.
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless
Detects modification of autostart extensibility point (ASEP) in registry.
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)
Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros
Detects the abuse of custom file open handler, executing powershell
Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes
Detects the registration of a new ODBC driver.
Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
Detects tampering with attachment manager settings policies attachments (See reference for more information)
Detect the creation of a service with a service binary located in a suspicious directory
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Page 86 of 101