Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects when the 'UseActionCenterExperience' registry value is set to 0, which disables Windows Security Center notifications. This can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Detects changes to the Windows EventLog channel permission values by monitoring modifications to the Security Descriptor Definition Language (SDDL) string in the registry. Such modifications can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify an event log channel. This action can prevent users from accessing the event log channel via Event Viewer or utilities like "Get-EventLog" or "wevtutil".
Detects when the 'DisallowRun' registry value is set to '1' under 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'. This registry setting prevents users from running specified computer programs, which can be used by adversaries for defense evasion or to restrict user capabilities.
This rule detects modifications to the Windows Registry related to Fax Device Providers, specifically looking for changes to the 'ImageName' value within the 'Software\Microsoft\Fax\Device Providers\' path. This technique can be used for persistence by loading a malicious DLL when the Fax service restarts, as highlighted in the provided references.
This rule detects attempts to modify the 'ServiceDll' registry value for the 'wercplsupport' service. This specific modification is associated with the Blue Mockingbird cryptominer, which uses this technique for persistence by hijacking a legitimate service to load its malicious DLL.
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
This rule detects modifications to Internet Explorer registry settings, which attackers can abuse for persistence or defense evasion. Specifically, it looks for changes within the 'Software\Microsoft\Windows\CurrentVersion\Internet Settings' registry path. Potential malicious activities include adding domains to the Trusted Sites Zone or injecting JavaScript for persistence. The rule filters out common benign modifications related to DWORD values, Office applications, cache, ZoneMap, WpadDecision paths, binary data, and changes made by 'RuntimeBroker.exe' or within 'Accepted Documents' to reduce false positives.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for the Service Control Manager (SCM) by modifying the 'TracingDisabled' registry key. Adversaries may do this to impair defensive capabilities and hide their activities, as ETW logs are crucial for security monitoring and incident response.
Detects the modification of the Windows Registry to configure a driver or service to persist and load even when the system is booted into Safe Mode (Minimal or Network). This technique can be used by adversaries to maintain access and execute malicious code in a restricted environment, potentially bypassing security controls that are not active in Safe Mode.
Detects the import of '.reg' files from suspicious user-controlled or temporary paths using the 'reg.exe' utility. This activity can be indicative of an adversary attempting to modify the Windows Registry for persistence, defense evasion, or other malicious purposes by importing registry keys from a location that is easily written to.
Detects the use of regedit.exe to import a registry file (.reg) into the Windows Registry. This activity can be used by adversaries for various purposes, including establishing persistence, modifying system configurations, or defense evasion.
Detects the use of 'regini.exe' to modify registry keys by importing an alternate data stream. This technique can be used for persistence, defense evasion, or other malicious activities by adversaries.
Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.
This rule detects modifications to the 'ObjectName' registry value for the Windows FAX service. Specifically, it triggers when the 'ObjectName' value is changed from anything other than 'NetworkService'. This change could indicate an adversary attempting to escalate privileges or establish persistence by associating the FAX service with a different user account, potentially one with higher privileges or a compromised account, to execute malicious code or maintain access.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects changes to the NGenAssemblyUsageLog registry key.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
Detects modifications to registry keys related to Microsoft Office "Trusted Locations" where an uncommon path is added. Attackers may leverage this to bypass macro security restrictions by adding their malicious document locations as trusted.
This rule detects potential persistence activity by monitoring modifications to the Outlook Today page settings in the Windows Registry. Attackers can leverage this feature by setting a custom URL in the registry keys `Software\Microsoft\Office\<version>\Outlook\Today\URL` or `Software\Microsoft\Office\<version>\Outlook\Today\UserDefinedUrl`, along with setting the `Stamp` value to `0x00000001`. This allows for the execution of arbitrary code when Outlook is opened, providing a persistent foothold on the system.
Detects changes to the "ExtErrorInformation" key in the Windows Registry to disable Event Tracing for Windows (ETW) logging specifically for rpcrt4.dll. This modification can be used by adversaries to impair defenses by hiding their activities related to RPC (Remote Procedure Call) communications.
Detects when the 'Notification_Suppress' registry value is set to 1 under 'SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration'. This action disables Windows Security Center notifications, which can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Detects modifications to a registry key which contain an IP address as data which is used by HoldingHands malware to update its C2 server IP address.
Page 29 of 47