Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects registry keys created in OceanLotus (also known as APT32) attacks
Blue Mockingbird
Sigma
Attempts to detect system changes made by Blue Mockingbird
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension.
This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.
This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.
Detects registry keys related to Ursnif malware.
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Detect VBoxDrvInst.exe run with parameters allowing processing INF file.
This allows to create values in the registry and install drivers.
For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys
This allows to create values in the registry and install drivers.
For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys
Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
Detects the import of the specified file to the registry with regedit.exe.
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
ShimCache Flush
Sigma
Detects actions that clear the local ShimCache and remove forensic evidence
Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
Detects the import of a alternate datastream to the registry with regedit.exe.
This rule detects the execution of Run Once task as configured in the registry
Detects the presence of a registry key created during Azorult execution
Detects NetNTLM downgrade attack
Detects any deletion of entries in ".*\shell\open\command" registry keys.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
Page 39 of 47