Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects modifications to the WDigest 'UseLogonCredential' registry key. Enabling this setting (setting it to 1) forces the WDigest SSP to store plaintext credentials in memory, which facilitates easier credential harvesting by attackers using memory dumping techniques.
Detects the addition of a 'DailyFitnessTracker' entry to the HKCU Windows Registry Run key, which is a technique used by Golang-based RATs to establish persistence. The rule monitors both 'reg.exe' command-line operations and PowerShell 'New-ItemProperty' cmdlets targeting this specific registry path.
This rule detects persistence attempts via Component Object Model (COM) hijacking. It identifies a specific process 'December_blob.exe' creating or modifying registry keys associated with COM CLSIDs (specifically InprocServer32) and simultaneously dropping or utilizing a file named 'hvcsrv.dll' within an 'IdentityNexusIntegration' directory. This combination of registry modification and file system activity suggests the registration of a malicious COM object to achieve execution persistence.
Detects the modification of InProcServer32 registry keys within the user's Classes/CLSID hive to point to a file located in the AppData directory. This pattern is commonly used for COM hijacking to achieve persistence or execute arbitrary code under the user's context.
Detects modifications to the Windows RunMRU registry key where the value contains suspicious strings such as 'powershell', 'curl', or long encoded strings. This behavior is indicative of potential command execution, persistence, or staging via the RunMRU list.
Detects the addition of a file path exclusion to Windows Defender via the command-line registry utility (reg.exe), followed immediately by the execution of gpupdate to force a policy refresh. This pattern is commonly used by adversaries to exclude malicious directories from security scanning and ensure the configuration change takes immediate effect.
Detects attempts to disable Windows Defender Tamper Protection via direct Registry modification or by executing PowerShell commands. Disabling Tamper Protection is a common tactic used by adversaries to facilitate further malicious activity, such as impairing security controls or deleting malware artifacts without interference from Windows Defender.
Detects modifications to the Windows Explorer RunMRU registry key where values contain suspicious commands such as 'powershell', 'curl', or long base64-encoded strings, indicating potential command execution or persistence attempts.
Detects the modification of InProcServer32 registry keys within the user's Classes/CLSID hive to point to a file located in the AppData directory. This pattern is commonly used for COM hijacking to achieve persistence or execute arbitrary code under the user's context.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects the addition of a 'DailyFitnessTracker' registry entry into the 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' key. This is a common persistence technique where programs are configured to execute automatically upon user login, utilizing either 'reg.exe' or PowerShell 'New-ItemProperty' to modify the registry.
Detects the creation of a scheduled task or registry manipulation involving the string 'psychedelicloveUtils' occurring within 30 minutes of the execution of the process 'psychedeliclove.exe'. This pattern is indicative of a persistence mechanism being established by potentially malicious software.
Detects modifications to Windows Registry Run keys that execute PowerShell scripts named 'Update.ps1' with hidden window and bypass execution policy flags. This pattern is consistent with Lightlife RAT persistence mechanisms.
Detects unauthorized modifications to the InprocServer32 registry key for the specific CLSID {2155fee3-2419-4373-b102-6843707eb41f}, a technique used by malware to achieve persistence by hijacking COM object instantiation to load a malicious DLL.
Detects pre-encryption defensive measures employed by the Monkey ransomware C++ variant. This rule triggers on behaviors including Microsoft Defender exclusion management, disabling of AMSI or ETW components, manipulation of system security settings via registry, and attempts to clear PowerShell or command-line history to facilitate anti-forensic evasion.
Detects evidence of CRPx0 ClickFix ransomware execution by monitoring the HKCU RunMRU registry key for patterns indicating the execution of obfuscated or malicious commands (PowerShell, curl, or base64 encoded strings) consistent with clipboard-hijacking social engineering campaigns.
Detects evidence of anti-forensic activities associated with the SparroWocky toolset. The rule monitors for the removal of the 'ProcAuditManager' service, deletion of the 'SnapCart' registry key, and the execution of a self-deleting batch script used to remove forensic artifacts.
Detects camera or microphone access events triggered by Chrome browser processes associated with AI agent contexts (e.g., Gemini, assistant, side panels, or extensions) where no user gesture or active video conferencing application is detected. This behavior is indicative of unauthorized or surreptitious media device usage by browser-based AI integrations.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Page 5 of 47