Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects the execution of GigaWiper malware registry modules. The rule monitors command-line activity for specific binary names associated with the GigaWiper malware family that perform registry modifications, such as key creation or deletion.
This rule detects the creation of a 'SymbolicLinkValue' registry value within the 'CloudFiles' 'BlockedApps' registry key. This specific registry modification is associated with techniques designed to bypass security restrictions, specifically related to the abuse of symbolic links in the context of Windows CloudFiles/OneDrive mechanisms to achieve unauthorized file system access or privilege escalation.
Detects the use of 'regedit.exe' with the '/s' flag to perform a silent import of a registry file. This behavior is often used by adversaries to modify system configurations, establish persistence, or perform other registry-based attacks without user interaction. This specific rule includes a check for a hardcoded path 'C:\Windows\System32\hello.reg', suggesting targeted activity.
Detects modifications to the Windows Registry where the 'EnableLUA' value is set to 0, which effectively disables User Account Control (UAC). This action is often performed by attackers to evade security prompts and maintain higher integrity levels during execution.
This rule detects obfuscation of the Windows Registry Run key paths (SOFTWARE\Microsoft\Windows\CurrentVersion\Run) through the insertion of arbitrary non-alphanumeric characters. This is a common evasion technique used to bypass simple string-based detections for persistent autostart registry entries.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring for suspicious registry modifications in HKCU\Software\Classes associated with auto-elevating binaries (such as fodhelper.exe, computerdefaults.exe, or eventvwr.exe), followed shortly by the execution of these binaries or their child processes. This pattern is indicative of an adversary attempting to elevate privileges by hijacking the command registry keys used by these trusted Windows binaries.
Detects the use of reg.exe to modify Windows Registry keys related to disabling or tampering with Windows Defender security settings, such as Real-time Monitoring, Tamper Protection, and various scanning features.
Detects attempts to disable Windows Defender real-time protection, behavior monitoring, or scan capabilities. This is achieved by monitoring for specific HKLM registry modifications under 'SOFTWARE\Policies\Microsoft\Windows Defender' or the execution of PowerShell cmdlets 'Set-MpPreference' and 'Add-MpPreference' with arguments designed to disable security features or add file/process exclusions, often observed during initial stages of ransomware attacks.
Detects persistence mechanisms used by Vidar/SnappyClient (Operation Turb00), specifically the creation of a malicious Windows service named CadenceOptimizer and the hijacking of a Svchost service-group (Brn_Agent) to load a malicious DLL (agt.dll) from the ProgramData directory with SYSTEM privileges.
This rule detects the creation or modification of the 'NoRun' registry value under the Explorer policies key. This policy is used to remove the 'Run' command from the Start Menu, effectively preventing users from launching applications via the standard Run dialog. Adversaries may use this to impair user interaction or as part of a broader defense evasion effort to restrict access to system utilities.
This rule detects registry value updates within the 'Microsoft\Windows\CurrentVersion\Installer\TempPackages' hive by processes other than standard Windows Installer-related binaries (e.g., msiexec.exe, TrustedInstaller.exe, or TiWorker.exe). Modification of this registry location by unauthorized processes may indicate an attempt to interfere with package installation, potential persistence, or defense evasion activities.
This rule monitors registry modifications targeting Windows Defender policies and Sysmon service configuration. Specifically, it tracks attempts to disable real-time protection, anti-spyware features, and service settings commonly used by adversaries to impair security monitoring and defensive tools, characteristic of defense impairment tradecraft.
Detects modifications to the 'BootExecute' registry value within the 'Session Manager' key. The 'BootExecute' value, typically set to 'autocheck autochk *', controls programs that execute automatically during the Windows boot process. Adversaries can add arbitrary executables or scripts to this multi-string value to achieve persistence and gain code execution before user logon.
Detects the modification of the 'NoLogOff' registry value under the Windows Explorer policies key. This policy, when enabled, prevents the 'Log Off' option from appearing in the Start menu, which may be an attempt by an adversary to impair user sessions or lock a user into a specific session on a compromised host.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
Detects malicious registry modifications performed via 'reg.exe', 'regedit.exe', or PowerShell that indicate attempts to establish persistence through Run keys and service creation, or to impair security defenses by disabling features such as Windows Defender's AntiSpyware and RealtimeMonitoring, as associated with the GOLD ENCOUNTER, STAC4713, and STAC3725 campaigns.
Page 11 of 47