Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule detects attempts to modify Remote Desktop Protocol (RDP) related registry keys using the `reg.exe` utility. Specifically, it looks for command-line executions of `reg.exe` that add or modify values within the `CurrentControlSet\Control\Terminal Server` registry path. The rule targets modifications related to RDP licensing, concurrent sessions, WinStation configurations (like `MaxInstanceCount`, `fEnableWinStation`, `TSUserEnabled`, `TSEnabled`, `TSAppCompat`, `IdleWinStationPoolCount`, `TSAdvertise`, `AllowTSConnections`, `fSingleSessionPerUser`, `fDenyTSConnections`), which could indicate an adversary enabling or reconfiguring RDP for persistence, lateral movement, or defense evasion.
Detects the use of 'regedit.exe' to import a registry file that originates from an Alternate Data Stream (ADS). This technique can be used by adversaries for persistence, defense evasion, or to modify system configurations by importing registry keys from hidden data streams.
Detects the execution of 'regini.exe', a legitimate Windows utility that can be used to modify registry keys by importing changes from one or more text files. This activity can be indicative of an adversary attempting to alter system configurations, achieve persistence, or evade defenses by manipulating the Windows Registry.
Detects the presence of a registry key created during Azorult malware execution. Specifically, it looks for modifications to registry keys ending with '\services\localNETService' within the 'SYSTEM\' hive, which is a known indicator for Azorult.
Detects modifications to the 'HKLM\SOFTWARE\Microsoft\HTMLHelp\data' registry key, which is associated with the RedMimicry Winnti playbook. This registry key can be used for persistence or defense evasion by adversaries.
Detects when the 'fAllowToGetHelp' registry value is set to 1, which enables the Remote Assistance feature on a Windows machine. This allows a specific user to establish an RDP connection for remote assistance.
Detects the modification of a registry value under `\Software\Winternals\BGInfo\UserFields\` where the `Details` field starts with '6', indicating a custom WMI query. This activity can be abused by adversaries to execute arbitrary WMI queries via BgInfo.exe, potentially leading to persistence or defense evasion.
Detects the modification or creation of the 'Database' registry value under 'Software\Winternals\BGInfo' which can be used by attackers to specify an external database path for BgInfo. This could be leveraged to exfiltrate information collected by BgInfo by directing it to a controlled location.
This rule detects modifications to the Windows Registry keys responsible for DHCP server Callout DLLs. Attackers can leverage this mechanism to install malicious DLLs that execute in the context of the DHCP server, leading to privilege escalation, persistence, and defense evasion. The rule specifically looks for changes to the 'CalloutDlls' and 'CalloutEnabled' values under the 'HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters' path.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
Detects registry modifications that hide internal tools or functions from the user, a technique often employed by malware such as Agent Tesla and Hermetic Wiper. The rule specifically looks for changes to registry keys related to hiding clock, health, network, power, and volume icons in the system tray, as well as disabling advanced explorer features like showing info tips or compressed file colors.
Detects a registry modification that disables security warnings for Microsoft Office macros, specifically setting the 'VBAWarnings' registry value to '1'. This configuration allows the execution of all macros, whether signed or unsigned, which can be abused by attackers for initial access, persistence, or defense evasion.
Detects potential persistence activity by monitoring the registration of new custom protocol handlers in the Windows Registry. Attackers can abuse this mechanism to establish persistence by setting a custom handler to execute malicious code when a specific URI scheme is accessed. The rule filters out common legitimate Microsoft protocols and applications installed in standard program file locations to reduce false positives.
Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
Detects when the 'reg.exe' utility is used to add or modify registry keys or subkeys in suspicious locations. These locations include paths related to AppDataLow, Windows OOBE policies, Winlogon, WDigest security providers, and Windows Defender. Such modifications can be indicative of persistence mechanisms, defense evasion, or other malicious activities.
This rule detects attempts to clear the ShimCache, a component of the Application Compatibility Database, which stores metadata about executed applications. Adversaries may clear this cache to remove forensic evidence of their activities. The rule specifically looks for command-line executions involving 'rundll32' with 'apphelp.dll' and 'ShimFlushCache' or '#250', or 'rundll32' with 'kernel32.dll' and 'BaseFlushAppcompatCache' or '#46'.
This rule detects the execution of 'VBoxDrvInst.exe' with specific parameters ('driver' and 'executeinf') that allow it to process INF files. This capability can be abused to create registry values and install drivers, potentially leading to persistence mechanisms such as modifying Run or RunOnce registry keys.
This rule detects attempts to clear the connection history for Microsoft Terminal Server Client (MSTSC) by deleting specific registry keys or values. This activity can be performed by an attacker to remove forensic evidence of their remote access to a system.
This rule detects the creation or modification of the 'MiniNt' registry key under 'HKLM\SYSTEM\CurrentControlSet\Control\'. The presence of this key, particularly after a system reboot, can prevent the Windows Event Log service from writing events, effectively disabling security event logging. This is a known technique used by adversaries for defense evasion.
This rule detects modifications to the 'Run Once' registry key, specifically targeting the 'StubPath' value within 'Microsoft\Active Setup\Installed Components'. This registry key is often used by legitimate applications for one-time execution tasks, but adversaries can abuse it to establish persistence or execute malicious payloads. The rule includes filters to exclude common legitimate modifications made by Google Chrome and Microsoft Edge installers, which frequently use this mechanism.
Detects the modification of a registry value related to BgInfo configuration, specifically within the 'UserFields' subkey, where the 'Details' field starts with '4' (indicating a WMI script). This modification can be abused to execute custom VBScript via 'BgInfo.exe', potentially leading to persistence or defense evasion.
Page 28 of 47