Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Hunting rule based off of T1112 technique "Modify Registry of Local Machine - cmd". No public in-the-wild intel reference available; correlate before alerting.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
This rule detects modifications to Windows Registry Run keys that point to suspicious directories associated with the SharkLoader malware (such as 'xwreg' or 'xgdf' subdirectories in AppData) or an abnormally located SystemSettings.exe executable, both of which are common indicators of persistence attempts.
Detects modifications to the Winlogon Shell or Userinit registry keys. These keys define the processes that run upon user logon. Adversaries modify these values to achieve persistence by pointing them to malicious binaries or scripts, often identified in this rule by the string 'win_guard_'.
Detects a registry modification where Pay2Key ransomware sets the 'shutdownwithoutlogon' value to 0 under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. This action disables the shutdown option in the Windows Start menu, a tactic used by the ransomware to maintain access to the infected system and ensure encryption processes are not interrupted by a reboot.
Detects OpenVPN Connect applying a server-controlled PAC AutoConfigURL to HKCU Internet Settings, potentially enabling proxy interception of user traffic. This is achieved when a malicious VPN server pushes a dhcp-option PROXY_AUTO_CONFIG_URL, causing the OpenVPN system-level agent to write the attacker-controlled URL to the user's registry hive.
Detects LCRYX ransomware modifying registry keys to impair analyst interaction. It specifically monitors for the creation of the Scancode Map registry key, used to disable keyboard input, and the modification of the SwapMouseButtons registry key, used to invert mouse button functionality.
Detects LCRYX ransomware establishing persistence by modifying the Winlogon Shell registry key and creating multiple VBScript-based entries in Windows Run keys. The rule monitors for registry modifications targeting known persistence locations with suspicious scripts as values.
Detects unauthorized modification of Windows Registry keys intended to disable core administrative tools, including Task Manager, Registry Editor, Command Prompt/Run dialogs, and the Control Panel. Additionally, it identifies the creation of 'DisallowRun' entries used to block security and remediation utilities like Process Explorer, Autoruns, and System Configuration tools.
Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
This rule detects potential registry enumeration activities targeting sensitive Windows system keys ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' or 'HKLM\HARDWARE\DESCRIPTION') that are associated with the execution of suspicious processes named 'systemki.exe' or 'sysklnd.exe'. These filenames are consistent with historical observations of the Sauron (also known as Strider) malware framework.
This rule detects modifications to specific Windows Registry keys used for keyboard layout remapping ('Scancode Map') or mouse button swapping ('SwapMouseButtons'). Such modifications can be used by adversaries to facilitate keylogging, persistent input redirection, or to impair user interaction. The rule prioritizes alerts where the change was initiated by script engines like wscript.exe or cscript.exe, which are common vectors for VBScript-based malware.
Detects modifications to Windows registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or suppressing UAC prompts, when performed by scripting engines like wscript.exe or cscript.exe. This activity is often associated with malware or adversarial post-exploitation efforts to impair defensive capabilities and maintain persistence.
Correlates suspicious Temp directory creation with immediate wallpaper registry modifications, a common pattern for Makop ransom notes.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
This rule detects a suspicious sequence of events: first, a modification to the 'ExtensionInstallForcelist' registry key, followed within one hour by access to browser credential stores (specifically 'Login Data' or 'Cookies' files). This combination suggests an attacker might be attempting to force the installation of a malicious browser extension to steal credentials.
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Detects registry modifications to SyncRootManager occurring alongside cldflt.sys activity, which may indicate manipulation of cloud synchronization roots.
This rule detects two indicators associated with ransomware activity: the modification of the 'legalnoticetext' registry value, which is often used to display ransom notes on the Windows login screen, and the execution of Notepad to open a file named 'HowToRestoreFiles.txt', a common indicator of a ransom note left by ransomware operators.
Page 17 of 47