Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
The rule detects modifications to specific registry keys associated with UAC bypass techniques, particularly those leveraging fodhelper.exe. It monitors changes to the 'ms-settings\Shell\Open\command\(Default)' and 'ms-settings\Shell\Open\command\DelegateExecute' registry values. These modifications are indicative of an attempt to bypass User Account Control by hijacking the execution flow of a trusted process.
This query detects attempts to disable or modify critical security services using either the 'sc.exe' utility or direct registry modification. This is a common defense evasion technique used by adversaries to weaken a system's security posture before performing further actions.
Traditional Endpoint Detection and Response (EDR) tools primarily monitor live registry APIs (like RegSetValue). Since the attacker modifies the hive file offline and the OS loads it automatically during the logon process, no suspicious registry API calls are ever triggered. This makes the persistence virtually invisible to standard behavioral monitoring until the malicious payload actually executes at logon.
Detects the creation of a new Microsoft Office Trusted Location via registry modification. Attackers abuse this feature to add a location they control, allowing macros or other active content to run without security warnings, bypassing Mark-of-the-Web (MotW) protections.
Detects when the 'AllowNetworkLocations' or 'AllowSubfolders' registry values are enabled for Microsoft Office. This change broadens the attack surface by allowing Office to trust documents from network shares or any subdirectory within a trusted path, which can be abused by attackers to execute malicious payloads from attacker-controlled shares or hidden directories.
Detects APT28's NotDoor backdoor registry modifications to establish persistence and disable Outlook macro security. Modifies LoadMacroProviderOnBoot, Level, and General registry keys to enable silent macro execution.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
Detects registry values containing Base64-encoded PowerShell commands. Attackers use this technique to obfuscate malicious commands in the registry for persistence or execution.
Detects modification of ms-settings Shell\Open\command registry key used for UAC bypass via fodhelper.exe. This registry key should never be modified by legitimate software.
Detects the creation or modification of registry values used by the Valley RAT malware to store its configuration and modular plugins. Silver Fox operators use this mechanism for persistence and to dynamically update C2 infrastructure.
This rule detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value to '1' under a key containing 'WDigest'. The detection specifically looks for this modification being performed by a process whose image name matches a custom batch file pattern (e.g., ending with '!light*.bat'). This activity is associated with Qilin ransomware, which has been observed using this technique for credential access.
Detects modifications to Windows Registry keys related to Remote Desktop Protocol (RDP) configuration. Malware like DarkGate is known to manipulate these settings to enable or modify RDP for persistence and remote access.
Detects modifications to the Windows Registry that disable critical security features, specifically related to Restricted Admin Mode, UAC remote token filtering, and DSRM logon behavior. Ink Dragon uses these modifications to facilitate lateral movement and maintain domain dominance.
This rule detects instances where 'regedit.exe' is launched by a parent process that is not commonly associated with its execution. It specifically filters out common legitimate parent processes like 'explorer.exe', 'msiexec.exe', and 'cmd.exe', and also excludes parent processes originating from standard Windows and Program Files directories. This helps to identify suspicious or unauthorized attempts to modify the Windows Registry.
This query identifies an anomalous pattern associated with behavior performed by NotDoor to establish persistence and avoid its detection.
NotDoor is a Outlook Macros to monitor incoming emails for specific triggers, and when the system receives such an email, it executes code paths found in the VBA macro. This allows an attacker to exfiltrate data, upload files, and execute commands on the victim’s computer while using an inconspicuous application as the C2.
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Below is a list of registry keys/values that are monitored by this rule:
- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Below is a list of registry keys/values that are monitored by this rule:
- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.
Hides the file extension through modification of the registry
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
This rule detects the modification of the Windows Registry to install or configure Chrome VPN extensions. Specifically, it looks for changes to the 'Software\Wow6432Node\Google\Chrome\Extensions' registry path where the 'update_url' value is set for a known list of VPN extension IDs. This method can be used by adversaries to establish persistence or gain initial access by forcing the installation of malicious or controlled VPN extensions.
Detects potential malicious modification of the 'IsCredGuardEnabled' property value within the WDigest registry key to disable Credential Guard on a system. This action is often performed in conjunction with 'UseLogonCredential' to manipulate credential caching, potentially leading to credential dumping.
Page 25 of 47