Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Faux Elevate Uac Bypass
YARA-L
This rule detects a Faux-Elevate UAC bypass technique. It correlates the launch of auto-elevated processes like 'fodhelper.exe' or 'eventvwr.exe' with the subsequent spawning of suspicious child processes such as 'powershell.exe', 'cmd.exe', or 'wscript.exe'. The detection is further refined by looking for malicious PowerShell patterns within the command line of these child processes, specifically keywords like 'IEX', 'DownloadString', 'Invoke-WebRequest', or '-enc'. Additionally, the rule identifies registry modifications targeting keys related to 'ms-settings\shell\open\command', which is indicative of a registry hijack often used in UAC bypasses.
Detects the Faux-Elevate UAC bypass technique where auto-elevated binaries (fodhelper.exe, eventvwr.exe) are abused to launch suspicious child processes like PowerShell or cmd.exe. The detection logic further correlates this with registry modifications related to UAC bypass (specifically 'Software\Classes\ms-settings\shell\open\command') and subsequent outbound network activity to retrieve payloads, indicating a full chain of execution and C2 communication.
Detects the creation of the 'WSPrint' scheduled task followed by specific registry modifications intended to hide the task from the Task Scheduler UI. This is a known persistence technique used by the UAT-9244 actor for its TernDoor backdoor.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects attempts to aggressively hijack file associations by modifying the Windows Registry using 'reg.exe' or 'cmd.exe'. Specifically looks for command-line arguments indicating deletion of 'UserChoice' registry keys (which define default applications for file types) and addition of 'ApplicationAssociationToasts' keys (which can suppress notifications related to file association changes). This behavior is indicative of an attacker trying to silently change default applications to maintain persistence or execute malicious code.
This rule detects attempts to hijack file associations by monitoring command-line executions of 'cmd.exe' or 'reg.exe' that involve deleting 'UserChoice' registry keys or adding 'ApplicationAssociationToasts'. This behavior is indicative of an adversary attempting to modify default program associations to achieve persistence or execute malicious code.
Detects the creation or modification of specific registry values (UXMP, UFID, UCID) in known Havoc C2 fallback registry paths (e.g., \SOFTWARE\Classes\Local Settings\Software\Microsoft\ and \SOFTWARE\Microsoft\SQMClient\) used by a modified Havoc Demon agent for C2 fallback and configuration.
This rule detects suspicious modifications to Remote Desktop Protocol (RDP) configurations via `reg.exe` and `netsh.exe`. Specifically, it looks for attempts to enable RDP by setting `fDenyTSConnections` to 0, modify the `UserAuthentication` setting in `RDP-Tcp` to 0, or add a firewall rule to allow RDP traffic on port 3389. These actions can indicate an adversary attempting to establish or facilitate remote access to a system.
Detects modifications to the registry values responsible for service recovery actions, specifically the 'FailureCommand' or 'FailureActions' values. This can indicate an attacker is configuring a service to execute a malicious payload upon failure for persistence or privilege escalation.
Detects a high volume of modifications to the default 'open' command for various file extensions in the registry. This technique is used by malware to prevent users from running applications or opening documents, effectively causing a denial of service.
This detection is designed to help you find activity related to COLDRIVER new ROBOT malware chain (NOROBOT/YESROBOT/MAYBEROBOT). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
The rule detects access attempts (Event ID 4663) to theAppIDSvc service object. This captures the moment a process interacts with the service's configuration, such as changing its startup type from "Manual" to "Auto" or forcing it to start.
The rule detects write access to files named NTUSER.MAN by monitoring Windows Security Event Log event ID 4663.
Detects suspicious modification of the Windows TIP AggregateResults registry key with large data indicative of persistence.
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Detects modifications to the Text Input Processor (TIP) registry key with unusually large binary data, which can be indicative of malware hiding persistent code. This specific registry key is not commonly used for storing large amounts of data, making large writes suspicious.
Detects a combination of suspicious registry persistence under the Microsoft TIP AggregateResults key and PowerShell launched with ExecutionPolicy Unrestricted referencing LunarApplication. Based on publicly described artefacts and intended for tuning and validation.
Detects persistence mechanism used by Valley RAT, associated with the Silver Fox APT. The malware stores its configuration or modular plugins as REG_BINARY data in the 'HKCU\Console' registry key.
Detects the modification of Microsoft Office Trust Center settings to weaken macro security policies. This is a common technique used by attackers to enable malicious macros in documents, bypassing default security controls.
This rule detects suspicious PowerShell commands that are written to the Windows registry. It specifically looks for registry events where the 'Details' field contains keywords indicative of PowerShell execution ('powershell', 'pwsh') combined with suspicious command elements. These suspicious elements include obfuscation flags or download capabilities such as 'iex', 'Invoke-Expression', 'DownloadString', 'DownloadFile', 'Net.WebClient', 'FromBase64String', '-w hidden', '-windowstyle hidden', '-ep bypass', '-executionpolicy bypass', '-enc ', and '-encodedcommand'. The presence of such commands in the registry may indicate a persistence mechanism, a configuration backdoor, or automated malware execution.
This rule detects attempts to disable Windows Defender and Windows Firewall via registry modifications using the 'reg add' command. Specifically, it looks for command-line arguments that include 'add', 'REG_DWORD', and keywords related to disabling Defender features (DisableAntiSpyware, DisableBehaviorMonitoring, DisableRealTimeMonitoring, DisableOAVProtection) or the 'mpssvc' service, along with setting the value to '4' or '1'. This activity is often associated with malware attempting to evade security controls.
Page 24 of 47