Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
65
63
11
9
8
Contributors
35
24
19
19
11
Categories
100
76
57
26
15
Platforms
172
2
1
Products / Services
56
45
34
9
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
Detects WScript.exe performing multiple registry queries against sensitive Windows Classes and file association keys. This pattern of behavioral profiling is consistent with Kimsuky's NUKESPED downloader or JSE loader identifying system configuration before payload execution.
Detects the NUKESPED backdoor component 'zlrenu8.exe' interacting with the 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' registry key. This activity is consistent with malware performing environment profiling or establishing persistence by targeting registry keys used for automatic startup.
Detects anomalous registry activity associated with the JFMBackdoor, specifically when the legitimate Windows utility fltMC.exe is used for registry modification or enumeration. This rule looks for high-frequency registry operations performed by fltMC.exe, particularly targeting common persistence locations or other registry paths, indicating potential malicious use following DLL side-loading.
Detects the NUKESPED (zlrenu8.exe) implant performing post-compromise reconnaissance. This rule monitors for registry enumeration and modification, as well as the spawning of common system discovery processes (e.g., net.exe, tasklist.exe, systeminfo.exe) and the querying of specific registry keys related to OS version and computer identification.
This rule detects a single process attempting to access credential-related files (e.g., browser login data, FTP client configurations) and/or registry keys (e.g., PuTTY, WinSCP sessions) from at least two different application types within a 60-second window. This behavior is indicative of an attacker attempting to rapidly harvest credentials from various sources on a compromised endpoint.
Detects registry queries targeting Internet Explorer security, Windows NT versions, and Internet settings, which are commonly used by LegionLoader for environment fingerprinting and sandbox evasion during the initial staging phase.
Detects suspicious enumeration of Internet Explorer security zone registry keys, a known sandbox and debugger fingerprinting technique used by LegionLoader. The detection triggers when processes originating from AppData/Roaming or descending from msiexec.exe perform multiple registry reads on sensitive IE configuration keys within a one-minute window.
Detects LegionLoader malware performing environmental fingerprinting by querying specific Windows registry keys (Internet Settings Zones and CentralProcessor) in rapid succession. This behavior is indicative of a multi-stage check to identify sandbox or virtual machine environments before executing the final payload.
Detects host reconnaissance activities performed by BeepRAT (Operation DragonClone) components such as HFY.exe, tcc.exe, or LuaJit.exe. The rule monitors for the spawning of system utilities like reg.exe to query specific registry keys (Windows NT version or Creeper persistence), systeminfo.exe for system enumeration, and wmic.exe for retrieving hardware and system information.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions — the value
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware
including Snatch and Qilin query this key to determine whether the host is already in
Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects registry queries for common virtualization-related artifacts (e.g., VMware, VirtualBox) performed by specific suspicious processes. This behavior is indicative of sandbox or virtual machine evasion techniques used by malware to detect if it is running in an analysis environment before executing its malicious payload.
Detects the use of reg.exe to query the Windows registry for information related to software versions or service configurations. This activity is often associated with discovery efforts to identify installed software, system configuration, or potential security controls.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
Detects when 'drun.exe' queries registry keys or values within the HKEY_LOCAL_MACHINE\SOFTWARE hive. This activity could indicate an attempt by the 'drun.exe' process to discover system configuration or installed software information.
Detects when a process, not identified as a standard web browser, queries specific Internet Explorer or Internet Settings registry keys from suspicious file paths (AppData\Roaming, AppData\Local\Temp, Temp). This behavior could indicate an attempt by malware or an attacker to gather browser-related information or modify settings.
Identifies the active execution of the modular RAT payload through the detection of its campaign-specific static mutex. Specifically, it looks for the creation of a mutex with the hardcoded string "IDG5FUAM3PSONBSInGIGSWSD".
Page 4 of 9