Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects modifications to COM object InProcServer32 registry keys within the user's registry hive (HKEY_USERS). Attackers often hijack COM objects to achieve persistence by pointing them to malicious DLLs or OCX files. This rule specifically filters out common legitimate paths (Windows directories, Program Files) and known installers to reduce noise.
Detects potential sideloading of malicious Chrome extensions by monitoring for unauthorized file creation of 'manifest.json' files within the browser's extension directories and unauthorized registry modifications related to extension management. The rule specifically excludes legitimate processes like 'chrome.exe' and 'GoogleUpdate.exe', aiming to identify third-party processes attempting to register or install browser extensions.
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Detects enabling of Developer Mode via AllowDevelopmentWithoutDevLicense under AppModelUnlock. This is the sole precondition for the UNCanny technique (loose-file AppX registration from a UNC path -> SYSTEM LoadLibraryW coercion/LPE via the Windows Store InstallService). Low fidelity in isolation - Developer Mode is common on dev endpoints; correlate with UNC loose-file registration and svchost UNC image loads.
Detects evidence of the BeepRAT malware (via known file names, loader behavior, and specific command-line arguments) and attempts to tamper with security software through process termination, service modification, or the addition of Windows Defender exclusions.
This rule detects registry interactions involving the HKCU\Software\Creeper registry key, which is associated with BeepRAT. The malware utilizes this registry path to dynamically retrieve or update its command-and-control (C2) server infrastructure, allowing the attacker to change infrastructure without modifying the embedded implant code.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.
Detects unauthorized processes modifying the registry value 'PONT_STRING' within the Outlook Options General key. This registry value controls the display of content download warnings in Microsoft Outlook. Modifying this key from a non-Outlook process is a technique used by threat actors, such as APT28, to bypass security warnings and facilitate the execution of malicious payloads or content within Outlook.
Detects modifications or creations of registry values within common Windows auto-start locations, specifically the 'Run' and 'Winlogon' keys. These locations are frequently abused by adversaries to maintain persistence on a host. The rule excludes common, legitimate installer and administration processes to reduce noise.
Detects modifications to Windows Registry keys commonly associated with COM hijacking. Attackers modify these keys to redirect legitimate system calls to malicious executables, achieving persistence and potential privilege escalation. This rule monitors for registry value creation or modification in keys related to shell open commands for MS-settings, MSC files, or executables.
Detects modifications to COM object InProcServer32 registry keys within the user's registry hive (HKEY_USERS). Attackers often hijack COM objects to achieve persistence by pointing them to malicious DLLs or OCX files. This rule specifically filters out common legitimate paths (Windows directories, Program Files) and known installers to reduce noise.
Detects modifications to Windows Defender registry keys responsible for defining file, path, process, or extension exclusions. Adversaries often modify these settings to prevent security software from scanning their malicious artifacts.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Shutdown Button". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects behavior associated with the Glove Stealer malware, specifically the disabling or modification of Windows Defender, the use of UAC auto-elevate binaries (fodhelper.exe, computerdefaults.exe) initiated by non-standard processes, and unauthorized modifications to Windows Defender registry keys.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Page 13 of 47