Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
65
63
11
9
8
Contributors
35
24
19
19
11
Categories
100
76
57
26
15
Platforms
172
2
1
Products / Services
56
45
34
9
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing, which are indicative of malicious discovery.
This rule detects registry interactions involving the HKCU\Software\Creeper registry key, which is associated with BeepRAT. The malware utilizes this registry path to dynamically retrieve or update its command-and-control (C2) server infrastructure, allowing the attacker to change infrastructure without modifying the embedded implant code.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
Detects host reconnaissance activity where the zlrenu8.exe process (associated with the NUKESPED backdoor/Kimsuky threat group) attempts to enumerate sensitive registry keys under HKLM\SOFTWARE and HKLM\SYSTEM. This behavior is indicative of post-exploitation discovery activities.
This rule detects unauthorized or suspicious queries against Windows Registry paths known to contain sensitive information, including security hives (SAM, SECURITY), application-specific secrets (PuTTY, OpenSSH, RealVNC), and system autologon credentials. It monitors both command-line executions of 'reg.exe' and PowerShell commands targeting these registry keys.
This rule detects a specific environmental keying pattern indicative of malware or reconnaissance tools attempting to identify hostnames and domain membership. It monitors for a sequence of activities occurring within a 30-second window: querying the registry for computer name configuration, executing a WMI query for system information, and querying environment variables. The detection further filters for processes that exhibit this behavior without subsequent network activity or child process creation, which is characteristic of 'silent' environmental keying techniques.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
This rule detects unauthorized or suspicious queries against Windows Registry paths known to contain sensitive information, including security hives (SAM, SECURITY), application-specific secrets (PuTTY, OpenSSH, RealVNC), and system autologon credentials. It monitors both command-line executions of 'reg.exe' and PowerShell commands targeting these registry keys.
Detects reconnaissance activity associated with Pay2Key ransomware, specifically sandbox or environment checks. This includes process lineage originating from 7ZipSfx temporary directories combined with registry queries for S-1-5-19 (SYSTEM account) or direct file system access to Avast installation directories to verify the presence of security software.
This rule detects an unusually high volume of registry access events (Event ID 4656) targeting either the 'HKLM' (HKEY_LOCAL_MACHINE) hive or 'System Registry' within a one-hour window. A count of 10 or more such events by a single user on a specific computer within an hour is considered suspicious. This activity could indicate an adversary attempting to enumerate system configurations, modify system settings for persistence, or gather information.
This rule detects attempts to query the Windows Registry for 'WindowsRuntime' and 'ActivatableClassId' using 'reg.exe', specifically looking for 'InstallService' or '/f InstallService' in the command line. This activity could be indicative of an adversary attempting to discover or interact with COM objects or services for persistence or privilege escalation.
This rule detects potentially suspicious host reconnaissance activities by monitoring for frequent execution of system information gathering utilities (reg.exe, wmic.exe, systeminfo.exe) or registry queries against HKLM software hives. It identifies users or hosts performing an anomalous volume of these activities, which is often indicative of post-exploitation discovery efforts.
Detects reconnaissance and C2 registration activity associated with the BeepRAT (DcRAT-derived) malware. The rule correlates registry queries, process execution (e.g., wmic, whoami, systeminfo), and file system activity related to the TCC loader chain, specifically focusing on how the implant gathers system hardware and user information to construct a unique client ID for command and control.
Detects suspicious registry queries and reads indicative of Reynolds ransomware performing system reconnaissance. This rule specifically looks for 'reg.exe query' commands targeting HKLM\SYSTEM\Setup, HKLM\SOFTWARE, HKLM\SYSTEM, and HKCU\SOFTWARE, as well as direct registry event monitoring for reads on 'OOBEInProgress' and 'SystemSetupInProgress' values within the HKLM\SYSTEM\Setup key, while filtering out common legitimate processes.
Detects CastleLoader generating campaign-specific Named Mutexes to prevent multiple instances from running concurrently on the compromised host. The rule specifically looks for mutex creation events initiated by Python processes where the mutex name contains keywords associated with CastleLoader campaigns like 'Castle', 'Background', 'ClickFix', or 'TrapPhone'.
Detects the use of reg.exe to query the Windows registry for information related to software versions or service configurations. This activity is often associated with discovery efforts to identify installed software, system configuration, or potential security controls.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Detects the DRAYN malware enumerating security software by querying the registry key associated with the Advanced Monitoring Agent. This behavior is indicative of an adversary performing discovery to identify installed security tools on a compromised system.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
Page 3 of 9