Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the creation of a scheduled task involving QEMU binaries or associated configuration files, correlated with registry modifications that reference similar artifacts. This pattern is indicative of potential malicious use of virtualization tools for persistence, execution, or environment cloaking.
This rule detects modifications to the Windows Registry that enable the 'Shutdown without logon' feature, which allows a user to initiate a system shutdown without needing to log in first. This setting is often modified by attackers or during unauthorized system reconfiguration to weaken access control or facilitate disruptive activities.
Detects the modification of the Windows Registry 'LegalNoticeText' key, which is used to display a message to the user upon logon. This specific rule flags the inclusion of known ransomware-related URLs or domains in the text, commonly used as a ransom note mechanism by adversaries.
Detects creation or modification of SilverFox/Sauron campaign-specific registry keys (Software\ODBDC, SOFTWARE\JDBCC, SOFTWARE\Sauron) and the 'revbs' value name used as infection state tracking markers.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
This rule detects modifications to sensitive Windows Registry keys under HKLM\SOFTWARE\Microsoft\Cryptography, such as Providers, OID, Trust, and Protectedroots. These keys control cryptographic services and trust stores on Windows systems. Modifications by non-system processes or accounts may indicate attempts to subvert trust controls, install rogue root certificates, or tamper with system-level security providers.
Detects anomalous registry activity associated with the JFMBackdoor, specifically when the legitimate Windows utility fltMC.exe is used for registry modification or enumeration. This rule looks for high-frequency registry operations performed by fltMC.exe, particularly targeting common persistence locations or other registry paths, indicating potential malicious use following DLL side-loading.
Detects anomalous registry activity by wscript.exe, specifically targeting keys associated with file association, COM object registration, or run-time startup locations. A high count of registry open operations by a scripting engine often indicates persistence installation or reconnaissance of system configuration.
Detects unexpected registry modifications (creation, deletion, or modification) performed by processes associated with 'Nearby Share' (quick_share.exe, nearby_sharing.exe). Legitimate registry activity related to Google Nearby Share or Windows native Nearby Sharing is excluded from this alert.
Hunts for the TiFlux agent executing commands to modify Windows Defender or Firewall registry keys to lower security postures.
Detects suspicious registry writes to HKLM StaticPluginMap or HKCU CLSID entries that could be used to redirect InstallService plugin loading. Adversaries may modify these registry keys to achieve persistence or defense evasion by hijacking the loading of legitimate plugins.
This rule monitors for specific registry modifications to the Windows LegalNoticeText key, which is a known behavior of Pay2Key ransomware to display ransom notes to the user upon logon.
Detects anomalous behaviors associated with the Remcos RAT watchdog, specifically the execution of host processes (svchost.exe, rmclient.exe, fsutil.exe) by non-standard parent processes, the creation of specific 'WD' or 'exepath' registry keys in HKCU\SOFTWARE used for persistence configuration, and rapid respawn patterns indicating a watchdog process restart loop.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
Detects LCRYX ransomware or similar malicious scripts using wscript.exe or cscript.exe to disable Windows security features and system controls via registry modifications, such as disabling UAC, Task Manager, and Registry Tools.
Detects registry queries targeting Internet Explorer security configuration keys, such as 'WarnOnHTTPSToHTTPRedirect' or those within the 'Internet Explorer\Security' path. These queries may indicate an attempt to identify or modify security settings to facilitate malicious activities like bypassing security warnings or weakening browser protection.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Detects the execution of osascript used to generate deceptive "Network latency" GUI prompts, tricking the user into granting TCC permissions.
Detects modifications to the Windows Registry 'AutoConfigURL' setting under 'Internet Settings' initiated by the OpenVPNConnect.exe process. This registry key controls the automatic proxy configuration (PAC file) for the system or user, which can be abused by adversaries to redirect network traffic through a malicious proxy server.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
Page 15 of 47