Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
KQL Query
KQL Query from file: Detect & mitigate potential Specula Exploitation
KQL Query from file: RID Hijacking Technique and Detection
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
This rule detects modifications to specific Windows Registry keys that are known to be used by BlackByte ransomware for privilege escalation and to prepare for lateral movement and encryption. Specifically, it looks for the setting of 'LocalAccountTokenFilterPolicy', 'EnableLinkedConnections', and 'LongPathsEnabled' to a DWORD value of '1'. These modifications can enable administrative shares for non-administrator accounts, allow for longer file paths, and potentially facilitate ransomware operations.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring modifications to specific registry keys. This includes changes that could allow unauthorized users access via 'fAllowUnsolicited', or enabling RDP via 'fDenyTSConnections' by setting their values to 'DWORD (0x00000000)'.
Detects changes to the "DisableRestrictedAdmin" registry value, which controls RestrictedAdmin mode. Disabling RestrictedAdmin mode can expose credentials to compromise during Remote Desktop Protocol (RDP) connections, making it easier for adversaries to harvest credentials during lateral movement. This rule identifies modifications to this critical security setting.
Detects potential malicious modification of the 'UseLogonCredential' property value within the WDigest registry key to enable clear-text credential storage. This modification can allow attackers to dump credentials from LSASS memory.
Detects modifications to specific Windows Registry keys that disable or modify features of internal Windows tools. These modifications are often used by malware to hinder system functionality or security mechanisms. The rule looks for changes to registry keys related to disabling the command prompt, control panel, run dialog, log off, password changes, workstation locking, registry tools, task manager, display settings, notification center, UAC consent prompt behavior, inactivity timeout, shutdown without logon, push notifications, and write protection for storage devices. The rule specifically looks for these registry keys being set to a DWORD value of '0x00000001' (to disable features) or '0x00000000' (to enable or modify behavior of certain features like UAC consent prompt, inactivity timeout, shutdown without logon, push notifications, and write protection).
This rule detects the use of the `reg.exe` utility to add or modify registry keys or subkeys in specific suspicious paths. These paths are often abused by adversaries for persistence, defense evasion, or to modify system behavior. The rule specifically looks for modifications to paths related to AppDataLow, Windows Policies, Winlogon, SecurityProviders (WDigest), and Windows Defender.
This rule detects attempts to clear the ShimCache (Application Compatibility Cache) on a Windows system. Adversaries may clear this cache to remove forensic evidence of executed programs. The rule specifically looks for `rundll32` executing `apphelp.dll` with `ShimFlushCache` or `#250`, or `rundll32` executing `kernel32.dll` with `BaseFlushAppCompatCache` or `#46`.
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Hides the file extension through modification of the registry
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)
Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert javascript for persistence
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.
Page 32 of 47