Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0".
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
This rule detects the creation or modification of a DLL path within the Windows Time service (W32Time) TimeProviders registry key. Adversaries may abuse this mechanism to establish persistence by registering a malicious DLL to be loaded and executed when the system boots. The rule specifically looks for changes to the 'DllName' value under 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders' and filters out known legitimate DLLs associated with the W32Time service.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable the showing of hidden files and system files. This technique is often abused by malware to hide its files from users.
Detects tampering with the "Enabled" registry key to disable Windows event logging for a specific event channel. This activity is often performed by adversaries to evade detection by security tools and analysts.
This rule detects when the Windows Defender service (WinDefend) is disabled by modifying its 'Start' registry key. This is a common technique used by attackers or malware to impair defenses and avoid detection.
Detects changes to the "MaxMpxCt" registry value, which specifies the maximum outstanding network requests for the server per client when negotiating an SMB connection. Ransomware threat actors, specifically BlackCat, have been observed increasing this value to handle a higher volume of traffic, potentially for data exfiltration or other high-volume network activities.
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index. Attackers can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files, which can be abused for persistence. The rule specifically looks for modifications to registry keys related to PersistentHandler and CLSID, while filtering out known legitimate system paths and default IFilter CLSIDs to reduce false positives.
Detects modifications to the 'ms-msdt' URI scheme in the Windows Registry, specifically when the 'TargetObject' starts with 'HKCR\ms-msdt\'. This activity could indicate an attempt to exploit CVE-2022-30190, a Microsoft Support Diagnostic Tool (MSDT) vulnerability, often referred to as "Follina". The vulnerability allows for remote code execution via specially crafted Microsoft Office documents.
Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
Detects modifications to the "Default" value of specific 'MyComputer' registry keys and their subkeys. This technique can be used by adversaries to establish persistence by pointing to a custom binary that will be launched when an associated action (e.g., opening 'My Computer') is executed. This method leverages less common registry locations for persistence compared to standard Run keys.
Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
Detects when attackers or tools disable Windows Defender functionalities by modifying specific registry keys. This rule looks for changes to various Windows Defender related registry paths, specifically setting DWORD values to either 0x00000001 (to disable certain features) or 0x00000000 (to disable other features like Tamper Protection or PUA Protection).
Detects the modification of the 'Ime File' registry value within the 'Keyboard Layouts' key to include an uncommon file extension. This technique can be used by attackers to load a malicious DLL into a process via the Windows Input Method Editor (IME) feature, typically after sending a WM_INPUTLANGCHANGEREQUEST message. The rule specifically looks for modifications where the 'Ime File' value does not end with the standard '.ime' extension, indicating potential malicious activity.
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects the modification of the "Ime File" registry value within the Keyboard Layouts key to point to suspicious folders. This technique can be used by attackers to load a malicious DLL into a process after sending a WM_INPUTLANGCHANGEREQUEST message, leveraging the Windows Input Method Editor (IME) feature for persistence or defense evasion. The rule specifically looks for DLL paths located in common temporary or user-writable directories, which are often abused by malware.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could leverage this to run malicious Python code within Excel without user notification.
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
Page 95 of 101