Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging within .NET processes by modifying specific registry keys. Adversaries may perform this action to evade detection by security tools that rely on ETW for monitoring .NET activity. The rule specifically looks for modifications to the 'ETWEnabled' and 'ETWFlags' registry keys under 'SOFTWARE\Microsoft\.NETFramework' or 'COMPlus_' prefixed keys, setting their values to '0' (disabled). This indicates an attempt to prevent the recording of loaded .NET assemblies and other relevant ETW events, thereby hindering security monitoring capabilities.
Monitors for the creation or modification of scheduled tasks in the Windows registry by processes other than common legitimate ones like svchost.exe. This can indicate an adversary establishing persistence or executing malicious code via scheduled tasks.
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. Adversaries may delete this key to cover their tracks after executing commands, especially in scenarios like clickfix techniques where users are lured into executing malicious commands via the run dialog.
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
This rule detects attempts by non-privileged users (IntegrityLevel: Medium or S-1-16-8192) to modify Windows service configurations in the registry. It specifically looks for command-line executions of 'reg' with 'add' or 'powershell' with 'set-itemproperty', 'sp', or 'new-itemproperty' that target service-related registry paths (containing 'ControlSet' and 'Services') and modify critical service parameters like 'ImagePath', 'FailureCommand', or 'ServiceDLL'. This activity could indicate an attempt to establish persistence or elevate privileges by hijacking service execution.
Detects potential persistence activity via Outlook Home Page by monitoring modifications to specific registry keys. An attacker can set a home page URL in Outlook's WebView registry keys to achieve code execution and persistence when a user opens a folder in Outlook.
This rule detects modifications to the 'NoLMHash' registry value, specifically when it is set to '0' (DWORD). Setting this value to '0' allows Windows to store LAN Manager (LM) hashes of user passwords in Active Directory and local Security Account Manager (SAM) databases. This action significantly weakens security as LM hashes are highly vulnerable to cracking, making credential theft easier for attackers. Attackers often enable LM hash storage to facilitate 'Pass the Hash' attacks or offline password cracking.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for .NET processes by modifying registry values. Adversaries might do this to impair defensive capabilities and hide their activities, particularly when using .NET-based malware or tools.
Detects changes to the "NoLMHash" registry value to allow Windows to store LM Hashes. Setting this registry value to "0" (DWORD) enables the storage of LAN manager hashes of passwords in Active Directory and local SAM databases, which can facilitate 'Pass the Hash' attacks.
Detects the disabling of crash dumps by modifying the 'CrashControl' registry key to set the 'CrashDumpEnabled' value to 0. This activity has been observed in malware like HermeticWiper to hinder forensic analysis.
Detects modifications to specific registry keys related to NetNTLM authentication settings. These modifications can indicate an attempt to downgrade NetNTLM security, potentially enabling NetNTLM downgrade attacks. The rule specifically looks for changes to 'lmcompatibilitylevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the LSA registry path to less secure values.
This rule detects modifications to the Windows Registry key `HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential` where its value is set to `0x00000001`. This modification enables the WDigest protocol to store clear-text credentials in memory, making them vulnerable to credential dumping attacks. Adversaries often enable this setting to facilitate the extraction of user credentials from the Local Security Authority Subsystem Service (LSASS) process.
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in the registry using dnscmd.exe, which can be used to execute code in the context of the DNS server (restart required). This technique can be used for privilege escalation or persistence.
Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class. This behavior could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.
Detects registry changes to Office trust records where the path is located in a potentially suspicious location, indicating that a macro-enabled document from an unusual or untrusted location has been allowed to run. This could be indicative of an attempt to bypass security controls by executing malicious macros from temporary folders, internet caches, or public user directories.
Detects registry modifications that disable internal tools or functions in explorer, a technique often used by malware like Agent Tesla to hinder user interaction or hide malicious activities.
This rule detects the creation or modification of a Windows service where the service binary's path is located in a suspicious directory. Adversaries often place malicious service executables in non-standard or temporary locations to evade detection and establish persistence. The rule specifically looks for service image paths containing '\Users\Public\', '\Perflogs\', '\ADMIN$\' or '\Temp\'.
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Detects changes to the "DisableRestrictedAdmin" registry value via process creation events. This registry value controls RestrictedAdmin mode, which prevents the transmission of reusable credentials to a remote system during Remote Desktop connections, thereby mitigating credential harvesting if the remote server is compromised. This rule specifically looks for command-line arguments that indicate an attempt to modify this registry key.
Page 27 of 47