Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
12
7
4
2
2
Contributors
6
6
5
4
4
Categories
8
8
5
4
4
Platforms
29
4
Products / Services
7
6
4
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
2
IDS Protocols
3
1
Detects modifications to the Windows UserInitMprLogonScript registry value. This registry entry allows the execution of a logon script whenever a user logs into the system. Adversaries can abuse this mechanism to achieve persistence by pointing this value to a malicious executable or script, such as 'SoftManager.exe' in this specific detection context.
Detects modifications to the Windows UserInitMprLogonScript registry value. This registry entry allows the execution of a logon script whenever a user logs into the system. Adversaries can abuse this mechanism to achieve persistence by pointing this value to a malicious executable or script, such as 'SoftManager.exe' in this specific detection context.
Detects modifications to the Windows UserInitMprLogonScript registry value. This registry entry allows the execution of a logon script whenever a user logs into the system. Adversaries can abuse this mechanism to achieve persistence by pointing this value to a malicious executable or script, such as 'SoftManager.exe' in this specific detection context.
Detects modifications to the Windows UserInitMprLogonScript registry value. This registry entry allows the execution of a logon script whenever a user logs into the system. Adversaries can abuse this mechanism to achieve persistence by pointing this value to a malicious executable or script, such as 'SoftManager.exe' in this specific detection context.
Detects modifications to the Windows UserInitMprLogonScript registry value. This registry entry allows the execution of a logon script whenever a user logs into the system. Adversaries can abuse this mechanism to achieve persistence by pointing this value to a malicious executable or script, such as 'SoftManager.exe' in this specific detection context.
Detects modifications to the UserInitMprLogonScript registry value that point to suspicious locations or file types (e.g., AppData, .js, .vbs). This registry key is commonly used for persistence by executing a script at user logon. The rule excludes common legitimate paths like NETLOGON or SYSVOL.
Detects modification of sensitive Active Directory LDAP attributes (msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, scriptPath, msTSInitialProgram, msDS-KeyCredentialLink) via Windows Security EventCode 5136, and correlates the initiating session back to its originating logon (EventCode 4624) to surface the actor's SID, domain, source IP, and logon host. These attributes are commonly abused for Kerberos delegation abuse (constrained/resource-based constrained delegation), logon-script/Terminal-Services persistence, and Shadow Credentials (msDS-KeyCredentialLink) attacks. Includes anchor fields (initiator SID, domain controller, distinct-attribute count, operation correlation ID) to support precise, low-blast-radius tuning instead of broad exclusions.
Detects suspicious modifications to Windows registry keys associated with logon script execution, such as 'UserInitMprLogonScript' or 'Userinit'. These locations are frequently abused by adversaries to achieve persistence by forcing the execution of malicious scripts or binaries upon user logon. The rule excludes modifications made by standard Microsoft Windows processes to reduce noise.
Detects the transmission of the 'UserInitMprLogonScript' registry value name over SMB traffic in plaintext. This registry key is commonly used by adversaries to establish persistence by executing a logon script whenever a user logs in.
Detects the transmission of the 'UserInitMprLogonScript' registry value name over SMB traffic in plaintext. This registry key is commonly used by adversaries to establish persistence by executing a logon script whenever a user logs in.
Detects suspicious modifications to Windows registry keys associated with logon script execution, such as 'UserInitMprLogonScript' or 'Userinit'. These locations are frequently abused by adversaries to achieve persistence by forcing the execution of malicious scripts or binaries upon user logon. The rule excludes modifications made by standard Microsoft Windows processes to reduce noise.
Detects deployment of malicious network logon scripts via domain SYSVOL
This rule detects when a Windows logon script (specifically a .bat file) is written to the NETLOGON share over SMB. This activity is often associated with persistence techniques where an attacker modifies or creates a logon script to execute malicious code when a user logs on to a domain-joined machine.
Detects logon scripts dropped to NETLOGON or SYSVOL for domain-wide execution
This rule detects attempts to modify a user's logon script via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS, often used for remote registry) where the content "UserInitMprLogonScript" is present, indicating an attempt to alter this specific registry key. This activity is often associated with persistence techniques used by attackers to maintain access to a system.
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" via command line, which can be used for persistence.
Detects the creation of the 'UserInitMprLogonScript' registry value, which can be leveraged by adversaries to establish persistence on a system. This registry key is designed to execute a script upon user logon, making it a valuable target for malicious actors seeking to maintain access.
Detects uncommon child processes spawned by "userinit.exe". Legitimate child processes of userinit.exe typically include explorer.exe, logon scripts (like netlogon.bat, UsrLogon.cmd), PowerShell.exe on Windows Core, and specific Citrix or proquota.exe processes. The rule aims to identify suspicious or malicious executables launched by userinit.exe, which could indicate persistence mechanisms or privilege escalation attempts.
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.
Detects the modification of the 'UserInitMprLogonScript' registry key to execute a PowerShell script with a hidden window. This persistence technique was used by the COLDRIVER APT group.
Page 1 of 2