Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
32
20
11
4
2
Contributors
30
10
7
5
5
Categories
40
32
20
16
9
Platforms
70
1
Products / Services
30
13
11
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects persistence attempts via modifications to Windows Registry Run keys, either through direct registry operations or via the execution of 'reg.exe'. It specifically flags suspicious registry value data (e.g., paths in Temp or AppData) and instances where non-standard binaries are utilized to perform these operations.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects the use of the Windows registry utility 'reg.exe' to query sensitive registry keys (SYSTEM, SOFTWARE, RUN keys) when executed by suspicious parent processes commonly used for script execution or living-off-the-land techniques (wscript.exe, cscript.exe, fltMC.exe, mshta.exe). This pattern is often indicative of automated discovery or credential harvesting behaviors.
This rule detects attempts to query the Windows Registry for 'WindowsRuntime' and 'ActivatableClassId' using 'reg.exe', specifically looking for 'InstallService' or '/f InstallService' in the command line. This activity could be indicative of an adversary attempting to discover or interact with COM objects or services for persistence or privilege escalation.
Detects the use of reg.exe to add a 'NvmProtocal' entry to the Windows Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). This behavior is indicative of a backdoor establishing persistence by scheduling the execution of node.exe with a hidden PowerShell window upon user logon.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Detects reg.exe saving the SYSTEM hive to \Windows\Temp\. This activity is often associated with credential dumping techniques where adversaries extract the SAM database for offline cracking.
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
Detects reg.exe saving the SECURITY hive to \Windows\Temp\.
Detects reg.exe saving the SAM hive directly to \Windows\Temp\, indicative of offline credential cracking.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects the use of reg.exe to save the SAM, SECURITY, or SYSTEM hives to the Temp directory for offline credential cracking, as observed in Seedworm espionage campaigns.
Detects scripts (Batch, PowerShell) that create a hidden local account (appended with $) and add it to highly privileged groups like Administrators and Remote Desktop Users.
This rule detects suspicious modifications to Remote Desktop Protocol (RDP) configurations via `reg.exe` and `netsh.exe`. Specifically, it looks for attempts to enable RDP by setting `fDenyTSConnections` to 0, modify the `UserAuthentication` setting in `RDP-Tcp` to 0, or add a firewall rule to allow RDP traffic on port 3389. These actions can indicate an adversary attempting to establish or facilitate remote access to a system.
Detects suspicious behavior where a Node.js-based application launches cmd.exe to query MachineGuid from the registry, indicating potential fingerprinting or persistence activity by EvilAi malware. The rule specifically looks for processes initiated from a suspicious folder path, where node.exe is the parent process, and cmd.exe is used to query 'HKLM\Software\Microsoft\Cryptography' for 'MachineGuid'.
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
Detects the deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. Adversaries may delete this key to cover their tracks after executing commands, particularly in techniques like those used in clickfix where phishing lures instruct users to execute malicious commands via the Run dialog.
Page 1 of 4