Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
Detects the import of the specified file to the registry with regedit.exe.
Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
Detects the import of a alternate datastream to the registry with regedit.exe.
This rule detects the execution of Run Once task as configured in the registry
Detects the presence of a registry key created during Azorult execution
Detects actions caused by the RedMimicry Winnti playbook
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
Hides the file extension through modification of the registry
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
Detects when the 'AllowMultipleTSSessions' value is enabled.
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
Which allows for multiple Remote Desktop connection sessions to be opened at once.
This is often used by attacker as a way to connect to an RDP session without disconnecting the other users
Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)
Detect the creation of a service with a service binary located in a suspicious directory
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Change the Fax Dll
Sigma
Detect possible persistence using Fax DLL load when service restart
Page 37 of 47