Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,112 detections
Filters
Last updated
All Time
Detection languages
1,010
660
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,872
5,155
4,866
2,112
Platforms
2,106
5
4
3
1
Products / Services
588
468
342
116
93
MITRE Techniques
1,579
817
814
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
This rule detects attempts to establish persistence by modifying specific registry keys related to the Windows Event Viewer's redirection functionality. Adversaries can manipulate these keys, specifically 'MicrosoftRedirectionProgram' and 'MicrosoftRedirectionURL', to execute arbitrary programs or open malicious URLs when a user interacts with the Event Viewer. The rule filters out legitimate modifications made by svchost.exe (likely via GPO) for default redirection programs and command-line parameters, as well as the default Microsoft events.asp URL and empty values, to reduce false positives.
Detects the creation or modification of user-specific or system-wide environment variables in the Windows Registry that contain suspicious commands, strings, or encoded payloads. This rule looks for common indicators of malicious activity such as PowerShell commands, temporary file paths, and various Base64 encoded strings often associated with malware or attacker tools.
This rule detects when an application or user re-enables older, less secure TLS versions (TLS 1.0 or TLS 1.1) by setting the 'Enabled' registry value to '1' under the 'Protocols' key in the Windows registry. This action can weaken the system's security posture by allowing communication over deprecated protocols.
Detects a specific UAC bypass technique leveraging Windows Media Player's `osk.exe` by monitoring modifications to a particular registry key. This technique, often associated with UACMe (specifically method 32), involves setting a 'Binary Data' value in the AppCompatFlags\Compatibility Assistant\Store registry path for `C:\Program Files\Windows Media Player\osk.exe`.
Detects when the 'windir' environment variable is modified from its default value. This modification is often a precursor to a User Account Control (UAC) bypass technique leveraging the 'SilentCleanup' scheduled task, which is an auto-elevated task that can execute with administrator privileges without prompting the user.
This rule detects modifications to the Internet Explorer ZoneMap Domains registry key, which can be used to add domains to specific security zones (e.g., Trusted Sites). Adversaries might modify these settings to lower security restrictions for malicious websites or to bypass security prompts.
Detects when the Windows Firewall is disabled by setting the 'EnableFirewall' registry value to 0 (DWORD 0x00000000) for either the StandardProfile or DomainProfile. This action can be performed by adversaries to bypass network controls and facilitate malicious activity.
Detects applications being added to the "allowed applications" list of Exploit Guard's Controlled Folder Access feature, specifically when these applications are located in suspicious paths. This action can be used by adversaries to bypass Controlled Folder Access protections and execute malicious code.
Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in the Windows Registry to achieve persistence. This persistence mechanism leverages the "SearchIndexer.exe" process to invoke the malicious DLL.
Detects the installation of 'NalDrv' or 'PROCEXP152' services by monitoring registry key modifications. These services are associated with the 'Ghost-In-The-Logs' tool, which leverages KDU for defense evasion. The rule specifically looks for the creation of these service ImagePath registry values in non-system32 folders, filtering out legitimate instances of tools like procexp and procmon.
Detects a specific UAC bypass technique (UACMe 52) that abuses a path parsing vulnerability in `winsat.exe`. This bypass involves modifying registry keys related to `winsat.exe` to point to a malicious executable located in a temporary directory, allowing for privilege escalation without a UAC prompt.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry values. These modifications can disable security features related to file attachments, such as hiding zone information, preventing the saving of zone information, or disabling antivirus scanning for downloaded files. Such actions are often performed by adversaries to evade detection and facilitate the execution of malicious files.
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Detects setting a custom URL for OneDriveStandaloneUpdater.exe to download a file from the Internet without executing any
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
anomalous executables with suspicious arguments. The downloaded file will be in C:\Users\redacted\AppData\Local\Microsoft\OneDrive\StandaloneUpdaterreSignInSettingsConfig.json
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.
Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun.
The disk cleanup manager is part of the operating system.
It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
The disk cleanup manager is part of the operating system.
It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes
Page 99 of 101