Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects modifications to CommonGlobUserSettings, used by Makop for UI/shell behavior manipulation.
Detects modifications to COM InprocServer32 registry keys under HKEY_CURRENT_USER. This activity is often associated with COM hijacking, a technique used by adversaries to achieve persistence or execute malicious code when a hijacked COM object is invoked by legitimate applications. The rule specifically flags suspicious or non-Microsoft COM registrations, particularly those pointing to files within the user's AppData/Local directory.
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Monitors for the empty DelegateExecute value insertion that forces Windows to fall back to legacy COM handler resolution.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Detects modifications to Chrome's ExtensionInstallForcelist policy to inject malicious extensions, specifically when initiated by cmd.exe or powershell.exe. This activity is associated with the UnregStealer malware.
Monitors for attempts to modify ClickOnce registry trust settings to suppress security prompts for unsigned packages, which can be used by attackers to install, persist, and update malware without administrative rights.
This rule detects attempts by PowerShell to modify the Windows Registry to re-enable Windows Script Host. This behavior has been observed with AsyncRAT, which may attempt to repair the script environment if it was disabled by defenders.
Monitors for the empty DelegateExecute value insertion that forces Windows to fall back to legacy COM handler resolution, as observed in Operation SilentCanvas.
Detects the environmental preparation stager modifying registry keys to forcefully re-enable Windows Script Host and restore .vbs file associations.
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
This rule detects modifications to specific registry keys that are commonly used for persistence by malware. The rule looks for Event ID 4657 (A registry value was modified) and checks if the ObjectName corresponds to known malicious registry paths related to Run keys, RunOnce, or service configurations. This indicates an attempt to establish persistence or alter system behavior for malicious purposes.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
Identifies inbound remote RPC calls targeting the Remote Registry interface to save registry keys (OpNums 20 and 31). This is frequently abused for remote credential dumping of SAM/LSA secrets.
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
Page 18 of 47