Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Looks for potential instances of bitlocker modifying registry settings to allow encryption, where it's executed via a .bat file.
'This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\.
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects registry entries that may indicate that an operator is trying to establish persistence for the Qakbot binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects registry entries that may indicate that an operator is trying to establish persistence for the Qakbot binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
'This detection looks for the steps required to conduct a UAC bypass using Fodhelper.exe. By default this detection looks for the setting of the required registry keys and the invoking of the process within 1 hour - this can be tweaked as required.'
Identify registry modifications that is indicative of a ransom note tied to DEV-0270.
This rule detects when Shadow Copies are being deleted. This is a know actions that is performed by TA.
This query detects know commands that have been used by the ransomware actors.
Some information from Mitre Attack:
https://attack.mitre.org/techniques/T1490/
This query detects know commands that have been used by the ransomware actors.
Some information from Mitre Attack:
https://attack.mitre.org/techniques/T1490/
BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption
Detects potential PowerShell commands or code within registry run keys
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could indicate an attempt to exploit CVE-2020-1048, a Windows Print Spooler elevation of privilege vulnerability, by registering a malicious printer port.
The analytic detects the creation of suspicious registry entries by Qakbot malware. These entries are characterized by 8 random hexadecimal registry value names with encrypted binary data, typically found under the "SOFTWARE\\Microsoft\\" path. The detection focuses on processes like explorer.exe, wermgr.exe, dxdiag.exe, OneDriveSetup.exe, mobsync.exe, msra.exe, and xwizard.exe making these modifications. This activity is a strong indicator of a Qakbot infection, as the malware uses the registry to store malicious code or configuration data, enabling persistence and arbitrary code execution on compromised systems.
Detects the registration of a new ODBC driver where the driver's DLL is located in a potentially suspicious or non-standard system directory. Adversaries may use this technique to establish persistence or facilitate credential access by registering malicious ODBC drivers.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects a process setting the RunOnce registry key and making suspicious network connections associated with DarkCloud Stealer.
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
Detects changes to the HypervisorEnforcedCodeIntegrity registry key where the "Enabled" value is set to 0, which disables the Hypervisor Enforced Code Integrity (HVCI) feature. Disabling HVCI allows an attacker to load unsigned and untrusted code into the kernel, potentially facilitating privilege escalation or defense evasion.
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803". Adversaries might enable this feature to collect system registry hives, which can contain sensitive information.
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value where it is set to "1" to disable the Hypervisor Enforced Paging Translation feature. This action can be taken by adversaries to evade detection by security tools that rely on this feature for monitoring or integrity checks, potentially facilitating kernel exploits or rootkit installations.
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups.
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" with a value of "0x00000001". This activity is significant because malware, such as RATs or trojans, often disable registry tools to prevent the removal of their entries, aiding in persistence and defense evasion. If confirmed malicious, this could hinder incident response efforts and allow the attacker to maintain control over the compromised system.
Page 91 of 101