Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
65
63
11
9
8
Contributors
35
24
19
19
11
Categories
100
76
57
26
15
Platforms
172
2
1
Products / Services
56
45
34
9
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.).
While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.
The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.
The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.
This rule detects attempts to query the Windows Registry via a web shell for system reconnaissance purposes. It specifically looks for HTTP requests containing the string "reg query" in the URI, indicating a command execution attempt to gather system information.
This rule detects attempts to enumerate remote registry keys via SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "winreg" and "RegQueryValue" in a case-insensitive manner. A threshold is applied to trigger an alert if 20 such events occur within a 30-second window from the same source.
This rule detects an unusually high volume of registry access events (Event ID 4656) targeting either the 'HKLM' (HKEY_LOCAL_MACHINE) hive or 'System Registry' within a one-hour window. A count of 10 or more such events by a single user on a specific computer within an hour is considered suspicious. This activity could indicate an adversary attempting to enumerate system configurations, modify system settings for persistence, or gather information.
This rule detects a high volume of Registry Hive bulk queries for system reconnaissance activities. Specifically, it looks for 30 or more 'RegEnumKey' operations over TCP port 445 (SMB) within a 30-second window, originating from a single source IP address and directed towards the protected network. This behavior can indicate an attacker attempting to enumerate registry keys to gather information about the system.
Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection. The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, like unusual command-line arguments, or known malicious behaviors associated with this tool. Specifically, it looks for `cpuz.exe` spawning `powershell.exe` with suspicious command-line arguments like `[Console]::In.ReadToEnd()` or `Invoke-Expression`, or `csc.exe` spawning `chrome.exe`.
The rule detects handle requests and access attempts (Event ID 4663) to the SrpV2\Exe registry key.
This rule detects modifications to the 'RunMRU' registry key, specifically looking for new or changed entries where the command string is unusually long (greater than 50 characters). This can indicate an attempt to persist or execute malicious code via the RunMRU list, which stores recently executed commands.
Detects the creation of the '___unique_id___' file in a temporary directory. This file is a specific artifact used by the PeckBirdy JScript framework to store a persistent victim identifier.
This rule detects suspicious activity related to Notepad++ updater (gup.exe or update.exe) executing reconnaissance commands or loading suspicious DLLs. Specifically, it looks for the updater process initiating common reconnaissance tools like cmd.exe, powershell.exe, or curl.exe with commands such as 'whoami', 'tasklist', 'systeminfo', 'netstat', 'ipconfig', or 'curl' that include redirection for staging. Additionally, it correlates this activity with the loading of suspicious DLLs (e.g., log.dll) from unusual locations like AppData or Temp folders, potentially indicating DLL sideloading.
Detects the creation of a file named '___unique_id___' in a temporary directory. This file is a specific host artifact created by the PeckBirdy framework to store a persistent victim identifier for tracking purposes.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
Detects handles requested to SAM registry hive
Detects suspicious behavior where a Node.js-based application launches cmd.exe to query MachineGuid from the registry, indicating potential fingerprinting or persistence activity by EvilAi malware. The rule specifically looks for processes initiated from a suspicious folder path, where node.exe is the parent process, and cmd.exe is used to query 'HKLM\Software\Microsoft\Cryptography' for 'MachineGuid'.
Detects the export of a crital Registry key to a file.
Detects the export of the target Registry key to a file.
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
This rule detects the SugarWraith loader DLL, which is associated with the UNK_SweetSpector threat group. It identifies the malware based on a combination of specific strings found within the binary, including error messages related to process and pipe creation, system information gathering strings, and network-related strings like "ngrok-skip-browser-warning" and "SecureProtocols". The presence of at least four of these strings indicates the potential presence of the SugarWraith loader.
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
Page 6 of 9