Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
15
2
2
2
1
Contributors
15
3
2
1
1
Categories
8
6
2
2
2
Platforms
14
5
4
1
Products / Services
12
10
9
6
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
1
IDS Classtypes
2
IDS Protocols
2
The following analytic detects modifications to the Windows registry under `SOFTWARE\Microsoft\Test`, a location rarely used by legitimate applications in a production environment. Monitoring this key is crucial, as adversaries may create or alter values here for monitoring update of itself file path, updated configuration file, or system mark compromised. The detection leverages **Sysmon Event ID 13** (Registry Value Set) to identify unauthorized changes. Analysts should investigate processes associated with these modifications, particularly unsigned executables or suspicious command-line activity, as they may indicate malware or unauthorized software behavior.
Page 2 of 2