Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
This rule detects attempts to disable the Microsoft Defender Firewall by modifying specific registry keys. It looks for changes to the 'EnableFirewall' DWORD value to '0x00000000' (disabled) within the FirewallPolicy profiles (DomainProfile, PublicProfile, StandardProfile) under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\.
Detects modifications to the Windows Registry that disable the System Restore functionality. This is achieved by setting specific registry values ('DisableConfig' or 'DisableSR') to '1' (DWORD 0x00000001) within the System Restore related registry paths.
Detects when an attacker attempts to add a new network provider by modifying the registry, which can be used to dump clear text credentials. This technique is similar to how tools like NPPSpy operate by registering a malicious network provider DLL to intercept credentials during the authentication process.
Detects changes to registry values related to Outlook security settings, which could indicate an attempt to modify Outlook's behavior for persistence or other malicious purposes. This rule specifically looks for modifications within the 'SOFTWARE\Microsoft\Office\<version>\Outlook\Security\' registry path.
Detects when an attacker attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This action can be part of privilege escalation or defense evasion tactics to bypass UAC prompts.
This rule detects the creation or modification of a registry run key that exhibits characteristics associated with the 'Small Sieve' malware. Specifically, it looks for a registry path containing '\Microsoft\Windows\CurrentVersion\Run\' combined with either the intentional typo 'Microsift' in the TargetObject or the string '.exe Platypus' in the Details field. These indicators are known to be used by the Small Sieve malware for persistence.
Detects suspicious modifications to BitLocker-related registry keys using the `reg.exe` utility. Adversaries may modify these keys to enable or disable BitLocker, potentially as a precursor to data encryption for impact (ransomware) or to facilitate data exfiltration by disabling encryption.
Detects the use of the 'reg.exe' utility to disable Protected Process Light (PPL) protection for the Local Security Authority (LSA) process. This modification can allow attackers to dump LSA secrets, which contain credential material.
This rule detects when the Windows Defender operational event log is disabled by setting its 'Enabled' registry value to 0. This activity has been observed in relation to Lockbit 3.0 ransomware infections as a defense evasion technique.
This rule detects modifications to registry keys that enable the Dynamic Data Exchange (DDE) protocol in Microsoft Word or Excel. Specifically, it looks for changes to 'AllowDDE' in Word or 'DisableDDEServerLaunch'/'DisableDDEServerLookup' in Excel to a value that enables DDE. Adversaries may enable DDE to execute arbitrary commands, often as part of phishing campaigns or through embedded files, to bypass macro-based defenses.
Detects changes to Outlook registry values indicating a reminder was triggered for a Note or Task item. This activity could be related to the exploitation of CVE-2023-23397, a critical vulnerability in Microsoft Outlook that allows for NTLM relay attacks without user interaction. Further investigation is required to determine the success of an exploitation.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This activity is associated with the SNAKE malware, as reported by CISA, which uses this technique for persistence.
Detects the setting of the "DumpType" registry value to "2" (Full Dump) within the Windows Error Reporting LocalDumps configuration. This specific setting is required by techniques like LSASS Shtinkering to facilitate dumping of the LSASS process memory, which often contains sensitive credential material.
Detects when an attacker registers a new SIP provider for persistence and defense evasion by monitoring modifications to the 'mpnotify' registry key under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\'. This registry key is associated with Winlogon helper DLLs, which can be abused to execute malicious code during user logon.
Detects the creation of a new user profile in the Windows Registry with specific usernames ('ANONYMOUS' or '_DomainUser_') within the ProfileList, which has been observed in some variants of the COLDSTEEL RAT malware. This indicates potential persistence or privilege escalation attempts by creating a new user account.
Detects the addition of new root, CA, or AuthRoot certificates to the Windows registry. Adversaries may install root certificates to subvert trust controls, allowing them to avoid warnings when connecting to adversary-controlled web servers or to sign malicious code that bypasses signature validation. This rule specifically looks for modifications to the 'Certificates' subkeys under 'Root', 'CA', or 'AuthRoot' paths within 'SOFTWARE\Microsoft\SystemCertificates', 'SOFTWARE\Policies\Microsoft\SystemCertificates', or 'SOFTWARE\Microsoft\EnterpriseCertificates' hives, where the 'TargetObject' ends with '\Blob' and 'Details' is 'Binary Data'.
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Detects the usage of "reg.exe" to add Windows Defender folder exclusions. This technique has been observed being used by QakBot (formerly Qbot) to add exclusions for folders within AppData and ProgramData, aiming to evade detection by the antivirus software.
Page 96 of 101