Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
The following analytic detects a suspicious registry modification that hides a user account from the Windows Login screen. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" with a value of "0x00000000". This activity is significant as it may indicate an adversary attempting to create a hidden admin account to avoid detection and maintain persistence on the compromised machine. If confirmed malicious, this could allow the attacker to maintain undetected access and control over the system, posing a severe security risk.
This analytic identifies instances where the `reg.exe` utility is launched from a command prompt (`cmd.exe`) that was not initiated by a user, specifically when the parent process is not `explorer.exe`. This activity is significant because `reg.exe` is commonly used for registry manipulation, which can be indicative of malicious behavior such as establishing persistence mechanisms or altering system configurations. If confirmed malicious, this could allow an attacker to modify critical system settings, potentially leading to privilege escalation or persistent access.
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Detects the modification of the 'Ime File' registry value within the 'Keyboard Layouts' key to include an uncommon file extension. This technique can be used by attackers to load a malicious DLL into a process via the Windows Input Method Editor (IME) feature, typically after sending a WM_INPUTLANGCHANGEREQUEST message. The rule specifically looks for modifications where the 'Ime File' value does not end with the standard '.ime' extension, indicating potential malicious activity.
This rule detects attempts to request write access to Windows Defender exclusion registry keys. This activity is highly suspicious as it could indicate an attacker attempting to modify or add new exclusions to bypass antivirus protection. The rule specifically looks for Event IDs 4656 (handle requested) or 4663 (object access attempt) in conjunction with write-related access rights (WriteData or AppendData) on registry paths containing '\Microsoft\Windows Defender\Exclusions\'.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects the modification of the PortProxy registry key, which is used for port forwarding. This can indicate an adversary setting up a proxy for lateral movement or command and control.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring changes to specific registry keys. This includes scenarios such as enabling RDP connections, allowing multiple RDP sessions per user, or disabling Network-Level Authentication (NLA) by setting the relevant registry values to '0'. Such modifications can facilitate unauthorized access or RDP hijacking.
Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.
Detects the addition of new root, CA, or AuthRoot certificates to the Windows registry. Adversaries may install root certificates to subvert trust controls, allowing them to avoid warnings when connecting to adversary-controlled web servers or to sign malicious code that bypasses signature validation. This rule specifically looks for modifications to the 'Certificates' subkeys under 'Root', 'CA', or 'AuthRoot' paths within 'SOFTWARE\Microsoft\SystemCertificates', 'SOFTWARE\Policies\Microsoft\SystemCertificates', or 'SOFTWARE\Microsoft\EnterpriseCertificates' hives, where the 'TargetObject' ends with '\Blob' and 'Details' is 'Binary Data'.
Detects changes to the registry for the currently logged-in user to disable PowerShell module logging, script block logging, transcription, or script execution logging. This activity is often performed by adversaries to evade detection by hindering forensic analysis and logging capabilities.
This rule detects the installation or modification of keyboard preload settings in the Windows Registry, specifically looking for suspicious keyboard layouts such as Persian (Iran) or Vietnamese. This activity is considered suspicious in environments where such layouts are not expected, particularly in systems maintained by US staff. The detection focuses on changes to the 'Keyboard Layout\Preload' and 'Keyboard Layout\Substitutes' registry keys.
Detects when the 'AllowMultipleTSSessions' registry value is enabled, which allows for multiple Remote Desktop Protocol (RDP) sessions to be opened concurrently. Attackers often leverage this to maintain access to an RDP session without disconnecting other legitimate users, facilitating persistence and potentially defense evasion.
This rule detects attempts to change the desktop wallpaper using PowerShell. It specifically looks for PowerShell script block text that either modifies the 'WallPaper' property within the 'HKEY_CURRENT_USER\Control Panel\Desktop\' registry key or calls the 'SystemParametersInfo' function with specific parameters (20, 0, *, 3), which is a Windows API call used to set the desktop wallpaper. This activity is indicative of an adversary attempting to deface a system.
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.
This rule detects attempts to establish persistence and evade defenses by registering a new Subject Interface Package (SIP) provider. Attackers can modify specific registry keys related to cryptographic providers to redirect signature validation functions to malicious DLLs. This allows them to bypass application control mechanisms by making the system trust unsigned or malicious code as legitimately signed. The rule specifically looks for modifications to registry paths associated with Microsoft Cryptography Providers and OID EncodingType, where the 'Dll' or '$DLL' values are being set, while filtering out known legitimate SIP registrations by the OS or specific software like WINTRUST.DLL and mso.dll. It also filters out specific legitimate activity related to poqexec.exe and PsfSip.dll.
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
Detects modifications to the Windows Registry that disable the Privacy Settings Experience. This can be an attempt by an adversary to impair defenses or hide their activities by preventing privacy-related notifications or settings from appearing.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The rule specifically looks for modifications to the 'Autorun', 'CleanupString', or 'PreCleanupString' registry values within the 'VolumeCaches' key, combined with specific executable names or common suspicious paths in the 'Details' field.
Page 46 of 47