Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
32
20
11
4
2
Contributors
30
10
7
5
5
Categories
40
32
20
16
9
Platforms
70
1
Products / Services
30
13
11
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
This rule detects attempts to modify the ImagePath value of a Windows service using the 'reg.exe' utility. Adversaries may hijack existing service registry entries to execute their own malicious payloads, leveraging flaws in permissions to redirect the service's executable to one they control. This allows them to achieve persistence and potentially privilege escalation when the service starts.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. The rule specifically looks for `wmic.exe` or `wmiprvse.exe` as a parent process, executing `reg.exe add` commands to modify `Run` registry keys, and targeting suspicious file paths commonly used by malware for persistence.
This rule detects suspicious modifications to screensaver settings in the Windows Registry using `reg.exe`. Adversaries may manipulate these settings to establish persistence by executing malicious content when a user is inactive. Specifically, it looks for `reg.exe` commands that modify the `ScreenSaveActive`, `ScreenSaveTimeout`, `ScreenSaverIsSecure`, or `SCRNSAVE.EXE` registry values within `HKEY_CURRENT_USER\Control Panel\Desktop` or `HKCU\Control Panel\Desktop` with the `/f` (force) flag.
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
This rule detects the use of the 'reg.exe' command-line tool to add entries to specific Windows Registry Run keys. These Run keys are commonly used by adversaries to establish persistence, ensuring that a malicious program executes automatically when a user logs in. The rule specifically looks for 'reg.exe' being executed with 'add' command and targeting 'Software\Microsoft\Windows\CurrentVersion\Run', 'Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', or 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' registry paths.
This rule detects attempts to modify Remote Desktop Protocol (RDP) related registry keys using the `reg.exe` utility. Specifically, it looks for command-line executions of `reg.exe` that add or modify values within the `CurrentControlSet\Control\Terminal Server` registry path. The rule targets modifications related to RDP licensing, concurrent sessions, WinStation configurations (like `MaxInstanceCount`, `fEnableWinStation`, `TSUserEnabled`, `TSEnabled`, `TSAppCompat`, `IdleWinStationPoolCount`, `TSAdvertise`, `AllowTSConnections`, `fSingleSessionPerUser`, `fDenyTSConnections`), which could indicate an adversary enabling or reconfiguring RDP for persistence, lateral movement, or defense evasion.
Detects direct modification of autostart extensibility point (ASEP) in the Windows Registry using the `reg.exe` utility. This rule specifically looks for the 'add' command within `reg.exe` command lines targeting common Run keys and other autostart locations.
Detects when the 'reg.exe' utility is used to add or modify registry keys or subkeys in suspicious locations. These locations include paths related to AppDataLow, Windows OOBE policies, Winlogon, WDigest security providers, and Windows Defender. Such modifications can be indicative of persistence mechanisms, defense evasion, or other malicious activities.
Detects the import of '.reg' files from suspicious user-controlled or temporary paths using the 'reg.exe' utility. This activity can be indicative of an adversary attempting to modify the Windows Registry for persistence, defense evasion, or other malicious purposes by importing registry keys from a location that is easily written to.
Detects modifications to the "PendingFileRenameOperations" registry key when initiated by suspicious or uncommon executable locations or by specific system utilities like `reg.exe` or `regedit.exe`. This registry key is used by Windows to stage files for renaming or deletion after a system reboot, and its manipulation can be a defense evasion technique to replace legitimate files with malicious ones or to remove forensic artifacts.
Detects registry modifications associated with the Gentlemen ransomware group. These changes are intended to weaken security controls for NTLM, Remote Desktop Protocol (RDP), and administrative access to facilitate lateral movement and persistence.
Detects the usage of "reg.exe" to tamper with various Windows Defender registry keys. This tampering aims to disable important features related to protection and detection, such as real-time monitoring, cloud protection, tamper protection, and other security functionalities. The rule specifically looks for `reg.exe` commands adding or modifying DWORD values to '0' or '1' for known Windows Defender settings.
Detects the use of `reg.exe` or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
Detects attempts to remove traces of Remote Desktop Protocol (RDP) activity by clearing specific event logs, deleting registry keys, or removing cache files. This rule identifies command-line actions using 'wevtutil' to clear RDP operational logs, 'reg delete' for RDP client registry keys, and 'del' or 'remove-item' for RDP bitmap cache files. It also directly monitors registry events for RDP client key deletions and file events for RDP cache file deletions.
Detects attempts to hide a user account from the Windows logon screen by modifying the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' registry key. Specifically, this rule looks for the use of 'reg.exe' to add a value of '0' to this key, which effectively hides the specified user account.
Detects direct modification of autostart extensibility points (ASEP) in the Windows Registry using the 'reg.exe' utility. This rule specifically looks for 'reg.exe' being executed with the 'add' command and targeting common autorun registry paths such as 'Run', 'Userinit', 'Shell', 'Windows', 'User Shell Folders', and 'AlternateShell'. Adversaries often modify these registry keys to establish persistence on a system, ensuring their malicious code executes upon system startup or user login.
This rule detects the use of the `reg.exe` utility to add or modify registry keys or subkeys in specific suspicious paths. These paths are often abused by adversaries for persistence, defense evasion, or to modify system behavior. The rule specifically looks for modifications to paths related to AppDataLow, Windows Policies, Winlogon, SecurityProviders (WDigest), and Windows Defender.
Page 2 of 4