Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects creation of Windows registry hive files (ntuser.dat or UsrClass.dat) outside the expected user profile path hierarchy. LegacyHive writes a modified ntuser.dat to a GUID-named staging directory at C:\ root (e.g. C:\{GUID}\ntuser.dat) and copies UsrClass.dat there as well to set up the oplock-based race condition. Any hive file materialising outside C:\Users\ or C:\Windows\ is a strong indicator of this exploit chain or equivalent offline hive manipulation.
Detects the use of the Windows 'reg.exe load' command to mount registry hive files from file paths other than the standard user-specific hive locations (ntuser.dat or usrclass.dat). This behavior is often associated with privilege escalation or post-exploitation techniques where attackers attempt to load sensitive system hives, such as SAM or SECURITY, into the registry for offline analysis or credential dumping.
Detects the TOKYOCORE ransomware processes (fsociety.exe or WindowsUpdate.exe) querying the Windows Uninstall registry key. This behavior indicates the malware is either enumerating installed security products to bypass them or attempting to register itself as an installed application.
Detects the mounting of a registry hive into an HKEY_USERS Classes root where the SID embedded in the registry key path does not match the SID of the process account that initiated the operation. This behavior is associated with the 'LegacyHive' exploitation technique, where an attacker attempts to mount another user's (or administrator's) registry hive into their own context to facilitate privilege escalation.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Detects specific registry modifications indicative of the NoEscape ransomware, including changes to desktop wallpaper settings, auto-colorization preferences, and Explorer shell policies used to restrict user interaction or modify system aesthetics as part of an extortion campaign.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects modifications to Windows Registry keys associated with executable file handling (exefile\shell\open\command, etc.) that set the handler to 'winnt32.exe'. This technique is used by the NoEscape ransomware to hijack the execution of legitimate programs and force the execution of its own malicious binary whenever an executable is run, ensuring persistence and impact.
Detects modifications to the Windows Registry that disable the ability for a user to change their desktop wallpaper by setting the 'NoChangingWallPaper' value within the 'ActiveDesktop' policy key to '1'. This is often associated with system tampering to enforce restricted user environments.
This query helps to identify service creation events regardless of the tool/method used for service creation (even if the threat actors use the Windows API directly, without leaving any command line traces).
Detects enabling of WDigest credential caching (UseLogonCredential=1) in the registry, followed within 6 hours by execution of common credential dumping tools (procdump, Mimikatz, NanoDump, taskmgr + LSASS/MiniDump/comsvcs) on the same host. This pattern is a strong indicator of post-exploitation credential access in high-tempo ransomware operations like Medusa (Storm-1175).
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects the execution of GigaWiper malware registry modules. The rule monitors command-line activity for specific binary names associated with the GigaWiper malware family that perform registry modifications, such as key creation or deletion.
Detects modifications to the Windows Registry key 'DisableTaskmgr' within the 'Policies\System' path, which is used to disable the Task Manager. This is a common tactic used by malicious actors to prevent users from monitoring or terminating malicious processes.
Detects modifications to Windows Defender exclusion settings by monitoring both PowerShell command lines containing 'Set-MpPreference' with 'ExclusionPath' and direct Registry modifications to the Defender exclusions key. Threat actors commonly use these techniques to bypass security scanning for malicious files or tools placed in the 'C:\ProgramData' directory.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Frequent Registry Modification Activity
Cortex XDR
This rule identifies processes performing a high volume of registry modifications by tracking unique registry key and value sets associated with user and process context. This behavioral pattern is often used to detect persistence mechanisms, configuration changes, or mass registry manipulation.
This query detects the specific credential access pattern used by Storm-1175 (Medusa ransomware operators).
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
Detects modifications to Windows Registry keys associated with UI lockdown behaviors, specifically disabling Task Manager, altering User Account Control (UAC) settings, modifying auto-colorization, or resetting default UI tiles. These modifications are often used by malware or malicious actors to inhibit user interaction, bypass security prompts, or persist UI-level restrictions.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects the execution of GigaWiper malware registry modules. The rule monitors command-line activity for specific binary names associated with the GigaWiper malware family that perform registry modifications, such as key creation or deletion.
Page 10 of 47