Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule detects attempts to establish persistence by modifying specific registry keys related to the Windows Event Viewer's redirection functionality. Adversaries can manipulate these keys, specifically 'MicrosoftRedirectionProgram' and 'MicrosoftRedirectionURL', to execute arbitrary programs or open malicious URLs when a user interacts with the Event Viewer. The rule filters out legitimate modifications made by svchost.exe (likely via GPO) for default redirection programs and command-line parameters, as well as the default Microsoft events.asp URL and empty values, to reduce false positives.
Detects the creation or modification of user-specific or system-wide environment variables in the Windows Registry that contain suspicious commands, strings, or encoded payloads. This rule looks for common indicators of malicious activity such as PowerShell commands, temporary file paths, and various Base64 encoded strings often associated with malware or attacker tools.
This rule detects modifications to the Internet Explorer ZoneMap Domains registry key, which can be used to add domains to specific security zones (e.g., Trusted Sites). Adversaries might modify these settings to lower security restrictions for malicious websites or to bypass security prompts.
Detects potential persistence activity via outlook home page.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
Detect set DisallowRun to 1 to prevent user running specific computer program
Hides the file extension through modification of the registry
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Yara rule that detects Zoldon ransomware.
Page 47 of 47