Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection. The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, like unusual command-line arguments, or known malicious behaviors associated with this tool. Specifically, it looks for `cpuz.exe` spawning `powershell.exe` with suspicious command-line arguments like `[Console]::In.ReadToEnd()` or `Invoke-Expression`, or `csc.exe` spawning `chrome.exe`.
Detects NetNTLM downgrade attack
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.
Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs.
It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell.
Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.
It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell.
Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.
Detects the deletion of registry keys containing the MSTSC connection history
Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information.
Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom WMI query via "BgInfo.exe"
Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Detects potential persistence activity via the registering of a new custom protocole handlers. While legitimate applications register protocole handlers often times during installation. And attacker can abuse this by setting a custom handler to be used as a persistence mechanism.
Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll
This alert detects a two stage behaviour associated with ClickFix style social engineering attacks, where a victim is tricked into manually executing a malicious command via the Windows Run dialog (WIN + R).
The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page.
The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download.
Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.
The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page.
The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download.
Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
Page 23 of 47