Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects suspicious Registry value modifications under HKEY_CURRENT_USER\SOFTWARE by processes like svchost.exe or iexplore.exe, involving specific keys associated with configuration (exepath, WD, FR, licence). This behavior is indicative of potential malware persistence or configuration manipulation.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
This rule detects an unusually high volume of registry access events (Event ID 4656) targeting either the 'HKLM' (HKEY_LOCAL_MACHINE) hive or 'System Registry' within a one-hour window. A count of 10 or more such events by a single user on a specific computer within an hour is considered suspicious. This activity could indicate an adversary attempting to enumerate system configurations, modify system settings for persistence, or gather information.
Detects attempts to disable or tamper with Windows Defender via command-line utilities, PowerShell scripts, or registry modifications. This includes stopping services (sc/net), modifying Defender preferences (Set-MpPreference), and tampering with policy registry keys.
Detects the modification of the WDigest registry key 'UseLogonCredential' to 1. This configuration forces the Windows LSA process to store plaintext credentials in memory, significantly facilitating credential harvesting techniques such as those employed by Mimikatz.
Detects the modification of the WDigest 'UseLogonCredential' registry value to 1 (enabling plaintext credential storage in memory) followed by subsequent access to the LSASS process, a common sequence in credential dumping attacks.
This rule detects a suspicious sequence of events: the enablement of Remote Desktop Protocol (RDP) via registry modification, followed by the creation of a new local administrator account with password expiration disabled, potentially accompanied by a netsh firewall rule modification to allow RDP. This combination of actions is highly indicative of an adversary establishing persistent remote access and creating a backdoor account.
Detects instances where msiexec.exe or related processes modify sensitive Windows Registry keys often associated with security settings, Internet Explorer configuration, or system identification. This behavior may indicate an attempt to tamper with security controls or prepare for further malicious activity.
This rule detects potentially malicious modifications to registry keys associated with Internet Explorer, Windows Internet Settings, or Windows NT configuration. It specifically looks for activity involving processes running from suspicious locations (e.g., AppData) or common abuse vectors like cmd.exe and msiexec.exe that perform these registry changes repeatedly, which may indicate persistence mechanisms or defense evasion.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.
Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.
Detects potential persistence or configuration activity associated with the Remcos Remote Access Trojan (RAT). The rule monitors for the creation or modification of registry keys explicitly named 'Remcos', as well as the addition of executables from suspicious paths (e.g., AppData, Temp) to the Windows 'Run' registry keys, a common technique for achieving persistence.
Detects potential persistence or configuration activity associated with the Remcos Remote Access Trojan (RAT). The rule monitors for the creation or modification of registry keys explicitly named 'Remcos', as well as the addition of executables from suspicious paths (e.g., AppData, Temp) to the Windows 'Run' registry keys, a common technique for achieving persistence.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Change Password Feature". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule based off of T1112 technique "Modify Registry of Local Machine - cmd". No public in-the-wild intel reference available; correlate before alerting.
Page 14 of 47