Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects modifications to the Chrome browser's registry key that stores extension settings. Adversaries may modify these registry keys to silently install, enable, or configure malicious browser extensions for persistence and credential theft.
Detects unauthorized attempts to disable Windows Defender Tamper Protection by setting the TamperProtection registry value to 0. This action allows an adversary to weaken system security, potentially enabling them to modify Defender exclusions or stop security services without interference.
Detects unauthorized or suspicious modifications to the SyncRootManager registry keys. This rule is designed to identify potential exploitation attempts, such as the ShieldCrash zero-day, which abuse the Windows CFAPI sync-root mechanisms to achieve privilege escalation or bypass security features. Legitimate synchronization software is explicitly excluded from this detection.
Detects modifications to the Windows RunMRU registry key that include suspicious strings such as 'powershell', 'curl', or long base64-encoded sequences. This behavior is indicative of the 'ClickFix' technique, where users are socially engineered to paste and execute malicious commands directly into the Windows Run dialog.
Detects the inclusion of PowerShell download commands ('irm' or 'Invoke-RestMethod') within the Windows 'RunMRU' registry key. This key is used by Windows Explorer to track recently typed run commands, and adversaries often abuse it to maintain persistence or store malicious one-liner payloads that are intended to be executed at a later time.
This rule detects two distinct malicious activities: 1) The presence or execution of files with specific SHA1/SHA256 hashes known to be malicious, identified across file creation, process execution, or as initiating processes. 2) The forced installation of browser extensions in Google Chrome or Microsoft Edge by identifying modifications to the 'ExtensionInstallForcelist' registry key.
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
This rule detects modifications to Windows 'Run' registry keys, specifically monitoring for the creation or value setting of keys associated with known suspicious or persistence-related names such as 'SMQDService' or 'winappx'. These registry keys are frequently used by attackers to maintain persistence by ensuring malicious code executes automatically upon user login.
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects unauthorized or suspicious modifications to the SyncRootManager registry keys. This rule is designed to identify potential exploitation attempts, such as the ShieldCrash zero-day, which abuse the Windows CFAPI sync-root mechanisms to achieve privilege escalation or bypass security features. Legitimate synchronization software is explicitly excluded from this detection.
This rule detects modifications to Windows Registry persistence keys (Run and RunOnce) associated with specific suspicious filenames ('cplsupport.exe', 'wtass.exe'), as well as modifications to specific Synapse agent configuration registry keys. These patterns are often associated with persistence mechanisms or unauthorized software configuration changes.
Detects suspicious command-line entries within the Windows RunMRU registry key, which logs recently executed commands from the Run dialog (Win+R). This detection targets common ClickFix or copy-paste attack patterns, specifically identifying the presence of 'powershell', 'curl', or long base64-encoded strings.
Detects the deletion of the registry key responsible for Chrome extension integrity verification (PreferenceMACs). Deleting this key allows an adversary to tamper with installed Chrome extensions without triggering security warnings. This activity has been observed in the Rapuncel campaign.
Detects the deletion of the registry key responsible for Chrome extension integrity verification (PreferenceMACs). Deleting this key allows an adversary to tamper with installed Chrome extensions without triggering security warnings. This activity has been observed in the Rapuncel campaign.
Detects suspicious modifications to browser 'Secure Preferences' files associated with known bypass techniques for extension integrity checks, coupled with browser process termination and subsequent relaunch using the --restore-last-session flag. This pattern is consistent with adversary activity attempting to inject malicious browser extensions by manipulating browser configuration files.
Detects modifications to the 'metrics_interval' registry value within the 'Software\SynapseAgent' key. This activity suggests configuration changes to the SynapseAgent, which could indicate tampering with agent telemetry or polling frequency.
Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.
Detects multiple methods of tampering with Windows security controls, including disabling Windows SmartScreen via registry, bulk removal of Mark-of-the-Web (Zone.Identifier) via scripting, and disabling driver signature enforcement (TestSigning/NoIntegrityChecks) using BCDedit. These actions are indicative of an adversary attempting to bypass security protections to facilitate the execution of untrusted or malicious code.
Page 6 of 47