Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
32
20
11
4
2
Contributors
30
10
7
5
5
Categories
40
32
20
16
9
Platforms
70
1
Products / Services
30
13
11
6
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects attempts to query the 'MachineGuid' from the Windows Registry using the 'reg.exe' utility. The MachineGuid is a unique identifier for a Windows machine and its discovery can be an early step in an adversary's reconnaissance phase to identify the system they have compromised.
Detects the use of the 'reg.exe' utility to disable Protected Process Light (PPL) protection for the Local Security Authority (LSA) process. This modification can allow attackers to dump LSA secrets, which contain credential material.
Detects modifications to Group Policy settings using `reg.exe` by looking for specific registry paths and keys commonly associated with Group Policy configurations. Malicious GPO modifications can be used to implement various other malicious behaviors, including privilege escalation and defense evasion.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
This rule detects attempts to enumerate credentials stored in the Windows Registry using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query for string values (`/t REG_SZ`) recursively (`/s`) within the HKLM (Local Machine) or HKCU (Current User) hives, or specifically targets the PuTTY sessions key in HKCU. This activity is indicative of an adversary searching for insecurely stored credentials that can be used for further access.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the execution of 'reg.exe' to modify registry keys associated with various Windows security services, attempting to disable them. This includes services like Windows Defender components (MsMpSvc, WinDefend, WdBoot, WdFilter, WdNisDrv, WdNisSvc), SecurityHealthService, AppIDSvc, NisSrv, Sense, UsoSvc, wscsvc, and wuauserv, by setting their 'Start' value to '4' (disabled).
This rule detects attempts to enumerate installed software versions on a Windows system using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query the registry for software version information, often found under `HKEY_LOCAL_MACHINE\Software\` paths and requesting the `svcVersion` value. This activity can be indicative of an adversary trying to identify vulnerable software or understand the system's security posture.
Page 4 of 4