Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects fileless malware storing payloads in registry keys for evasion
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects the creation or modification of the non-standard registry key (ms-pu\CLSID) used by the Mustang Panda PlugX variant to store its 16-character hex client identifier. This specific registry path is highly indicative of PlugX activity.
Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.
Explorer File Visibility Downgrade
Cortex XDR
Detects modifications to Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) to conceal files. This technique is often used by malware, such as GammaWorm, as a defense evasion mechanism to hide malicious artifacts from users and security tools. The rule specifically looks for changes to the 'Advanced' registry key path within 'Software\Microsoft\Windows\CurrentVersion\Explorer' that would result in files or file extensions being hidden.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
This rule detects an unusually high volume of registry access events (Event ID 4656) targeting either the 'HKLM' (HKEY_LOCAL_MACHINE) hive or 'System Registry' within a one-hour window. A count of 10 or more such events by a single user on a specific computer within an hour is considered suspicious. This activity could indicate an adversary attempting to enumerate system configurations, modify system settings for persistence, or gather information.
Detects modifications to the 'BlockedApps' registry key within the CloudFiles policy path, specifically looking for symbolic link setups pointing to the Volatile Environment as used in the MiniPlasma LPE exploit.
Identifies modifications to the Volatile Environment registry key altering the windir value to a non-standard path, a prerequisite setup step for the MiniPlasma LPE exploit.
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
Detects the use of regedit.exe to silently or explicitly import a .reg file located in the C:\ProgramData\ directory. This technique is used by threat actors, such as those deploying Nimbus RAT, to establish persistence.
MiniPlasma Registry Modification
Cortex XDR
This rule detects attempts to create or modify registry keys or values within the '.DEFAULT\Volatile Environment' path or 'Software\Policies\Microsoft\CloudFiles\BlockedApps'. Modifications to these keys can be indicator of the MiniPlasma privilege escalation technique
Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.
Detects processes modifying or querying Windows Defender registry keys related to Potentially Unwanted Application (PUA) protection (PUAProtection, MpEnablePus). This behavior is observed in the SessionGate malware to verify its execution environment and evade detection before deploying further payloads.
Detects registry modifications to Windows Explorer Advanced settings designed to hide file extensions, hidden files, and protected operating system files. This defense evasion technique is commonly used by malware, such as Gamaredon's GammaWorm, to conceal dropped payloads and replaced LNK files from the user.
Page 19 of 47