Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
979 detections
Filters
Last updated
All Time
Detection languages
467
248
152
48
27
Contributors
196
172
133
106
90
Categories
463
262
226
216
121
Platforms
968
2
2
1
1
Products / Services
321
203
165
53
46
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
979
CVEs
5
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the use of reg.exe to create persistence via Windows Registry Run or RunOnce keys using specific naming conventions commonly associated with Stealer/1.0 malware (e.g., SystemUpdate, SystemCheck) targeting files located in the Downloads directory.
Detects the enablement of the Remote Desktop Protocol (RDP) by modifying registry keys or service configurations, specifically when triggered by identified remote access tools or common script interpreters (cmd, powershell, etc.) executing from non-standard user-writable paths such as Temp or AppData. This behavior is indicative of lateral movement preparation.
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Detects creation of a mandatory profile hive (NTUSER.MAN) matching the size produced by the RegLoadAppKeyW -> ORCreateKey/ORSetValue/ORSaveHive offreg.dll API sequence used to forge an offline registry hive for persistence, as observed with the TWINLOOT Python implant. TWINLOOT builds the offline hive via offreg.dll (RegLoadAppKeyW, ORCreateKey, ORSetValue, ORSaveHive) with Run key or COM hijack values baked in, then writes it to %USERPROFILE%\NTUSER.MAN so Windows loads it in preference to NTUSER.DAT at the next user logon, achieving persistence with no registry events, no admin privileges, and no visibility to standard tooling. Tightened to exclude the process image when it is a known legitimate profile-management or provisioning tool (USMT, SCCM, Intune Management Extension) that also uses offreg.dll to build NTUSER.MAN during normal mandatory/roaming profile deployment.
Detects GhostTask-style hidden scheduled task persistence associated with the TWINLOOT Python implant framework. Legitimate scheduled tasks always write a security descriptor (SD) value under HKLM\...\Schedule\TaskCache\Tasks\<GUID>\SD alongside the corresponding HKLM\...\Schedule\TaskCache\Tree\<TaskName> entry. GhostTask abuses RegLoadAppKey/offreg.dll to build the TaskCache structure offline, producing a Tree entry and a Tasks\<GUID> key WITHOUT the accompanying SD value. The absence of the SD value combined with presence of the Tree entry is the key differentiator from normal task creation, which always writes SD. This technique is used by TWINLOOT to establish persistence while evading standard registry-event-based detections that rely on the presence of an SD value.
Detects activity (opens, reads, or writes) involving the Windows Registry key associated with Chrome's App Paths. Modifying this key is a common method for achieving persistence or hijacking the execution path of the Chrome browser.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects modification of the CoolClient rootkit's stealth-configuration registry value (Wid_H1deF5Dirs) under the \SYSTEM\RNG hive.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
This rule detects unauthorized modifications to the Chrome 'ExtensionInstallForcelist' registry key. This key is used to force-install browser extensions. Adversaries often abuse this mechanism to persist malicious browser extensions without user interaction. The rule filters out known legitimate processes associated with policy updates such as gpupdate, mmc, and services.
This rule detects unauthorized modifications to the Chrome 'ExtensionInstallForcelist' registry key. This key is used to force-install browser extensions. Adversaries often abuse this mechanism to persist malicious browser extensions without user interaction. The rule filters out known legitimate processes associated with policy updates such as gpupdate, mmc, and services.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects unauthorized modifications to Windows Registry keys responsible for forcing browser extensions. Attackers often abuse 'ExtensionInstallForcelist' and related policy keys in Google Chrome, Microsoft Edge, or Brave to silently install malicious extensions for persistence or credential theft. This rule flags modifications performed by processes other than known system administration or GPO management tools.
Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
This rule monitors the Windows Registry 'RunMRU' key for entries that include command execution patterns such as 'cmd.exe' or '%COMSPEC%' combined with suspicious arguments like 'finger' or 'cmd /c'. The RunMRU key stores the history of commands entered into the Windows 'Run' dialog, and this detection identifies potentially malicious command execution patterns often associated with malware loaders attempting to run secondary payloads or obfuscated commands via the shell history.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects creation of Chromium/Edge NativeMessagingHosts registry keys or supporting files (native_host.py, *.api.json) pointing to non-Program Files locations such as AppData, Temp, or ProgramData, consistent with the Edgecution malicious edge extension backdoor's native messaging host persistence mechanism used by UNC6692 to enable extension-to-native-process IPC.
This rule detects the presence of the Edgecution native_host.py Python backdoor by identifying specific, hardcoded code structures used for XOR deobfuscation. It specifically looks for the decryption loop combined with the registry lookup against 'HKCU\SOFTWARE\Microsoft\Edge' used to derive the decryption key, as well as distinct function names and error strings associated with the malware's implementation.
Generic rule content from file: TOKYOCORE Winlogon Hijack: Userinit/Shell, Notify DLL, Forced Auto-Logon
Page 9 of 47