Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the UAC bypass technique employed by the BQTLock ransomware, where the registry key 'HKCU\Software\Classes\mscfile\shell\open\command' is hijacked to execute arbitrary binaries such as BQT.exe or malicious scripts via eventvwr.exe, effectively elevating privileges.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects the modification of the 'UseLogonCredential' registry value within the WDigest configuration key to 1. Enabling this value forces Windows to cache user credentials in plaintext in the memory of the Local Security Authority Subsystem Service (LSASS), which is a common post-exploitation step to facilitate credential harvesting using tools like Mimikatz.
Detects high-frequency registry access (more than 50 events in a 1-minute window) by processes executing from common temporary, user-profile, or writable directories (e.g., AppData, Temp). This behavior is often associated with malware activity, such as credential dumping, persistence installation, or configuration modification.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
Detects suspicious PowerShell activity characteristic of the ScreenConnect AsyncRAT campaign, specifically the use of Add-MpPreference to add Windows Defender exclusions for RegAsm.exe and drive roots, and the modification of ConsentPromptBehaviorAdmin to suppress UAC prompts. These actions facilitate process hollowing and malware execution with elevated privileges.
Detects modifications to Windows Defender registry keys responsible for defining file, path, process, or extension exclusions. Adversaries often modify these settings to prevent security software from scanning their malicious artifacts.
Detects registry modifications (get, set, delete, rename) performed by the Filter Manager utility (fltMC.exe) targeting common Windows software and class registry keys. While fltMC is a legitimate Windows utility for managing filter drivers, its interaction with these specific registry hives is highly suspicious and may indicate unauthorized persistence or configuration tampering.
Detects suspicious browser-downloaded executables using image, screenshot, document, invoice, scan, or receipt-themed filenames that execute from user-writable locations and are followed by suspicious payload creation, Run-key persistence, or outbound network activity. This behavior is commonly associated with malware loaders, fake image/document lures, and user-executed initial access payloads.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects modifications to the 'UseLogonCredential' registry value under the WDigest security provider. Enabling this setting allows Windows to store plaintext credentials in memory (LSASS), which facilitates credential theft and credential dumping attacks.
Detects modifications to specific registry keys related to Internet Explorer and Windows Internet settings, specifically those controlling HTTPS-to-HTTP redirects and app container isolation for binary controls. Attackers may manipulate these settings to bypass security restrictions or facilitate browser-based attacks.
Detects the modification of the 'NoFind' registry value within the 'Policies\Explorer' key, which is used to disable the Windows Search functionality for users. Adversaries or unauthorized users may modify this setting to impair system search capabilities or as part of a broader system hardening or lockdown policy.
Detects registry modifications (specifically key creation or value setting) initiated by QEMU system binaries or their child processes, focusing on paths commonly associated with persistence (Run keys) or general software configuration storage.
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects unexpected registry modifications (creation, deletion, or modification) performed by processes associated with 'Nearby Share' (quick_share.exe, nearby_sharing.exe). Legitimate registry activity related to Google Nearby Share or Windows native Nearby Sharing is excluded from this alert.
Detects modifications to Windows Registry keys responsible for UAC behavior (ConsentPromptBehaviorAdmin and EnableLUA) performed by common command-line utilities. Such modifications can be indicative of attempts to disable or weaken User Account Control (UAC) to facilitate privilege escalation or defense evasion.
Page 12 of 47