Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
65
63
11
9
8
Contributors
35
24
19
19
11
Categories
100
76
57
26
15
Platforms
172
2
1
Products / Services
56
45
34
9
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
The FileFix StealC campaign's final-stage loader is written in Go and performs VM/sandbox checks plus string encryption before executing the infostealer.
Detects suspicious process command lines that access sensitive cryptocurrency wallet data files or registry keys associated with wallet applications, which is a common behavior of information-stealing malware.
Detects a sequence of activity where a process queries Windows Registry keys related to installed Python versions, followed shortly by the invocation of Python-to-executable compilation tools like Nuitka or PyInstaller. This pattern is indicative of an adversary or developer performing interpreter discovery before compiling a payload into a standalone executable.
Detects the use of reg.exe to query the MachineGuid value from the Windows Registry (HKLM\SOFTWARE\Microsoft\Cryptography). This behavior is often associated with adversary reconnaissance, specifically host fingerprinting, to uniquely identify compromised machines.
Remote Registry Access via Winreg RPC
Cortex XDR
Detects suspicious remote registry operations performed through the Winreg RPC interface. The rule monitors for interactions with sensitive registry hives (e.g., SAM, SECURITY, SYSTEM) or anomalous levels of remote registry activity originating from remote connections (SMB, TCP, Named Pipes). Such activity is often associated with credential dumping tools like Impacket's secretsdump or unauthorized remote configuration discovery.
Detects access, retrieval, or modification of the 'RegisteredOrganization' registry value under 'SOFTWARE\Microsoft\Windows NT\CurrentVersion'. This key often contains information about the registered owner or organization of the Windows installation and is frequently queried or modified during reconnaissance or environment configuration.
Detects processes that systematically query registry keys associated with Outlook configuration and VNC remote access software (RealVNC, TightVNC, TigerVNC). Querying multiple distinct families of these sensitive keys in a short period is characteristic of automated reconnaissance by tools, such as the Remus malware framework, attempting to identify installed software and potential configuration details.
Detects anomalous registry enumeration or modification activities targeting software uninstallation registry keys (Run/Uninstall). By monitoring for multiple subkey accesses by processes not associated with standard software management tools (like MsiExec or explorer), this rule identifies potential reconnaissance or software discovery patterns indicative of malicious activity.
Detects remote registry operations performed through the Winreg RPC interface. This behavior is commonly associated with adversary tools like secretsdump used to extract sensitive Windows registry hives such as SAM, SECURITY, and SYSTEM. Monitoring remote registry access is crucial for identifying unauthorized data collection and credential access attempts.
Detects anomalous registry enumeration or modification activities targeting software uninstallation registry keys (Run/Uninstall). By monitoring for multiple subkey accesses by processes not associated with standard software management tools (like MsiExec or explorer), this rule identifies potential reconnaissance or software discovery patterns indicative of malicious activity.
Detects the starting of the RemoteRegistry service via command-line utilities such as 'sc.exe' or 'net.exe'. This service is often started by adversaries to facilitate remote access to the Windows Registry for reconnaissance or enumeration of logon sessions.
Detects anomalous registry enumeration or modification activities targeting software uninstallation registry keys (Run/Uninstall). By monitoring for multiple subkey accesses by processes not associated with standard software management tools (like MsiExec or explorer), this rule identifies potential reconnaissance or software discovery patterns indicative of malicious activity.
Detects anomalous registry enumeration or modification activities targeting software uninstallation registry keys (Run/Uninstall). By monitoring for multiple subkey accesses by processes not associated with standard software management tools (like MsiExec or explorer), this rule identifies potential reconnaissance or software discovery patterns indicative of malicious activity.
Detects anomalous registry enumeration or modification activities targeting software uninstallation registry keys (Run/Uninstall). By monitoring for multiple subkey accesses by processes not associated with standard software management tools (like MsiExec or explorer), this rule identifies potential reconnaissance or software discovery patterns indicative of malicious activity.
Detects registry query operations targeting the App Paths registry keys for Google Chrome and Microsoft Edge by processes other than the browsers themselves. This behavior is often indicative of reconnaissance or software discovery activities where an adversary attempts to identify installed browser locations, which may be a precursor to browser-based attacks such as credential theft or browser hijacking.
The following analytic detects an access request on the uninstall registry key. It leverages Windows Security Event logs, specifically event code 4663. This activity is significant because adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks. If confirmed malicious, this behavior could allow attackers to map out installed software, potentially identifying vulnerabilities or software to exploit, leading to further system compromise.
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Detects a registry or environment variable query for the Chrome or Edge installation path performed by a process other than the browser itself.
This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2.
Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2.
Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
Detects a registry or environment variable query for the Chrome or Edge installation path performed by a process other than the browser itself.
This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2.
Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2.
Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
Detects a registry or environment variable query for the Chrome or Edge installation path performed by a process other than the browser itself.
This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2.
Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
This is a low-fidelity, contextual precursor indicator only and is not indicative of malicious activity on its own. It matches the initial step of the msaRAT living-off-the-browser pattern, where a non-browser process resolves the Chrome/Edge install path before driving a headless browser instance over the Chrome DevTools Protocol for covert C2.
Analysts should manually correlate hits from this rule with the separate 'Headless Chrome or Edge Launch with Remote Debugging Enabled' rule, looking for the same process (Image here matching ParentImage there) triggering both events within a short time window (e.g. a few minutes), before treating this as suspicious.
Page 1 of 9