Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
65
63
11
9
8
Contributors
35
24
19
19
11
Categories
100
76
57
26
15
Platforms
172
2
1
Products / Services
56
45
34
9
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
Detects the export of critical Registry keys (SAM, SECURITY, SYSTEM) to a file using regedit.exe. This activity is often associated with credential dumping or exfiltration of sensitive system information.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
Detects the export of a target Registry key to a file using 'regedit.exe' with the '-E' command-line argument. This rule specifically filters out common critical keys (HKLM\SYSTEM, HKLM\SAM, HKLM\SECURITY) to reduce false positives and focus on other potentially malicious registry exports.
Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.
Remote registry management using REG utility from non-admin workstation
Detects activity that could be related to Baby Shark malware
Detects the export of the target Registry key to a file.
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).
Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
Make sure you set the SACL to propagate to its sub-keys.
Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
Make sure you set the SACL to propagate to its sub-keys.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detect multiple Active Directory LDAP queries made in bin time
Replace 10 on line 1 with your desired thershold
Replace 1m on line 2 with your desired bin time
Replace 10 on line 1 with your desired thershold
Replace 1m on line 2 with your desired bin time
Detects activity mentioned in Operation Wocao report
Detects activity mentioned in Operation Wocao report
Detects activity mentioned in Operation Wocao report
Detects activity that could be related to Baby Shark malware
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects handles requested to SAM registry hive
'Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx().
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
Detects the export of the target Registry key to a file.
Page 7 of 9