Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects when an attacker modifies the 'Debugger' value within the 'AeDebug' registry key to establish persistence. This mechanism ensures that a specified malicious executable or DLL is launched whenever an application crashes, providing a persistent foothold on the system.
Detects attempts to disable Windows Defender Tamper Protection by modifying the relevant registry key. Tamper Protection is a security feature that prevents malicious programs from changing important security settings.
Detects when Windows developer features like "Developer Mode" or "Application Sideloading" are enabled by modifying specific registry keys. This allows users to install untrusted packages, potentially bypassing code signing requirements and enabling the execution of malicious applications.
This rule detects a User Account Control (UAC) bypass technique that leverages the Windows Event Viewer (eventvwr.exe). Specifically, it looks for modifications to the registry key `\mscfile\shell\open\command`. This registry key is associated with how .msc files (Microsoft Management Console snap-ins) are opened. By manipulating this key, an attacker can hijack the execution flow when eventvwr.exe is launched, causing it to execute an arbitrary command with elevated privileges without a UAC prompt. This is a known method for privilege escalation and defense evasion.
Detects when the 'AllowMultipleTSSessions' registry value is enabled, which allows for multiple Remote Desktop Protocol (RDP) sessions to be opened concurrently. Attackers often leverage this to maintain access to an RDP session without disconnecting other legitimate users, facilitating persistence and potentially defense evasion.
Detects the abuse of the 'exefile' handler in new file associations within the Windows Registry. This technique can be used by adversaries to bypass security products by associating a malicious executable with a common file extension, causing the malicious executable to run when a user interacts with that file type.
Detects potential persistence by monitoring for modifications to the Excel Options registry key, specifically looking for the addition of an Excel Add-in (XLL) file that would cause it to run automatically when Excel starts. This technique is often used by adversaries to maintain access to a compromised system.
Detects the modification or creation of registry values related to .NET Framework CLR and .NET Core CLR profiling. Specifically, it looks for 'COR_ENABLE_PROFILING', 'COR_PROFILER', 'CORECLR_ENABLE_PROFILING', and 'CORECLR_PROFILER_PATH' being set. Adversaries can abuse these environment variables to load malicious DLLs into .NET processes for persistence, privilege escalation, or defense evasion.
This rule detects the registration of new ODBC (Open Database Connectivity) drivers by monitoring modifications to specific registry keys. It specifically looks for changes within the `\SOFTWARE\ODBC\ODBCINST.INI\` path where the `TargetObject` ends with `\Driver`. The rule includes filters to exclude common legitimate ODBC driver registrations for SQL Server, Microsoft Access, and Microsoft Excel to reduce false positives.
This rule detects modifications to Microsoft Office registry keys that disable the Protected View feature. Adversaries may disable Protected View to bypass security warnings and execute malicious code embedded in Office documents without user intervention. The rule specifically looks for changes to registry values that control Protected View for attachments, internet files, intranet files, and unsafe locations, setting them to a disabled state (DWORD 0x00000001) or enabling specific protected view settings (DWORD 0x00000000).
This rule detects when the 'DLLPath' registry value for WAB.exe is modified to point to a DLL path different from the default one. WAB.exe is a legitimate Windows binary that can be abused to load arbitrary DLLs, a technique often used for defense evasion and persistence.
Detects modifications to Windows Defender exclusion registry keys, which adversaries may use to disable or bypass antivirus scanning for specific files or paths.
Detects tampering with the 'File' key within the Windows EventLog service registry path. This modification can be used by adversaries to change the default location of an EVTX log file, thereby hindering log collection and alerting mechanisms. The rule specifically looks for changes to the 'File' value in any EventLog service subkey, excluding changes that merely point to the default 'System32\Winevt\Logs\' directory.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
This rule detects the creation of new entries in the AppCompatFlags\Compatibility Assistant\Store registry key. This key is used by Windows to track applications that have been executed for the first time on an endpoint. This detection can indicate the introduction and initial execution of new software, which could be legitimate or malicious.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects the execution of 'reg.exe' to modify registry keys associated with various Windows security services, attempting to disable them. This includes services like Windows Defender components (MsMpSvc, WinDefend, WdBoot, WdFilter, WdNisDrv, WdNisSvc), SecurityHealthService, AppIDSvc, NisSrv, Sense, UsoSvc, wscsvc, and wuauserv, by setting their 'Start' value to '4' (disabled).
This rule detects suspicious modifications to the Windows Registry related to the 'ms-settings' URI scheme, specifically targeting the 'DelegateExecute' value or the default value of 'HKCU\Software\Classes\ms-settings\Shell\Open\Command'. This technique can be used by adversaries to hijack the execution of applications launched via the 'ms-settings' URI, potentially leading to arbitrary code execution or privilege escalation. The rule also includes a detection for the deletion of the 'ms-settings' key, which could be an attempt to clean up after such an attack.
This rule detects attempts to disable the automatic creation of administrative shares (C$, ADMIN$) at system startup by modifying specific registry values. Adversaries might do this as a defense evasion technique to remove traces of their activity or to hinder forensic analysis, as administrative shares are often used for legitimate remote administration and can also be leveraged by attackers for lateral movement.
Detects attempts to disable the runtime scanning of enabled macros in Microsoft Office by modifying the 'MacroRuntimeScanScope' registry key. This modification can be used by adversaries to bypass security features like AMSI (Antimalware Scan Interface) for VBA macros, allowing malicious macros to execute undetected.
Detects when Windows Defender Exploit Guard Network Protection is disabled by a registry modification. This action can be taken by an adversary to bypass security controls and facilitate malicious network activity.
Page 97 of 101