Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
22
19
6
2
1
Contributors
11
11
6
5
3
Categories
18
14
13
12
10
Platforms
50
1
1
Products / Services
15
12
9
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
IDS Classtypes
1
IDS Protocols
1
Detects activity (opens, reads, or writes) involving the Windows Registry key associated with Chrome's App Paths. Modifying this key is a common method for achieving persistence or hijacking the execution path of the Chrome browser.
Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)
Detects modifications to Windows Registry keys associated with executable file handling (exefile\shell\open\command, etc.) that set the handler to 'winnt32.exe'. This technique is used by the NoEscape ransomware to hijack the execution of legitimate programs and force the execution of its own malicious binary whenever an executable is run, ensuring persistence and impact.
Detects unauthorized registry modifications to file association handlers under HKCR and HKCU. This behavior is used to achieve persistence by hijacking the default command executed when opening specific file types, a technique identified in Kimsuky APT's NUKESPED post-exploitation activity.
Detects modifications to Windows Registry keys responsible for the 'open' command handler associated with 'exefile'. Adversaries often modify these registry keys to achieve persistence or execute malicious code whenever an executable is opened, by injecting commands or replacing the default handler.
Detects CldFlt.sys driver load activity coinciding with SyncRootManager registry modifications by non-standard processes, indicating potential RedSun exploitation of CVE-2026-41091 via the Cloud Files filter driver path. This correlation suggests an attempt to establish persistence or escalate privileges by manipulating system components related to cloud file synchronization.
This rule detects potential User Account Control (UAC) bypass attempts involving eventvwr.exe. It monitors for three suspicious patterns: eventvwr.exe spawning a child process that is not mmc.exe, modification of the HKCU\Software\Classes\mscfile\shell\open\command registry key used for hijacking file associations, and eventvwr.exe being launched from a non-standard system directory.
Detects when the SSH daemon or associated client binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) are overwritten or newly created on a Linux system. This is a highly suspicious activity often associated with rootkits, backdoors, or persistence mechanisms aimed at intercepting credentials or maintaining unauthorized remote access.
Detects high-frequency registry modification activity by Windows script hosts (wscript.exe or cscript.exe) targeting common persistence locations such as Run keys and file association command keys. This behavior is indicative of malicious scripts attempting to establish persistence or hijack system execution flows.
This rule detects modifications to Windows Registry persistence keys (Run keys, ControlSet, and file class associations) where the value being written contains strings associated with virtualization (qemu, .qcow2), potential malware/tools (bisrv.dll), or sensitive components (vault.db, TPMProfiler). This behavior is indicative of an adversary attempting to establish persistence or inject malicious modules via registry hooks.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects suspicious registry writes to HKLM StaticPluginMap or HKCU CLSID entries that could be used to redirect InstallService plugin loading. Adversaries may modify these registry keys to achieve persistence or defense evasion by hijacking the loading of legitimate plugins.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects modification of file associations to hijack execution flow
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects modification of registry keys that trigger event-based execution for persistence
This rule detects attempts to modify default file associations via the remote registry, specifically looking for 'HKCR' (HKEY_CLASSES_ROOT) and 'shell\\open\\command' within TCP traffic on port 445 (SMB). This activity is often associated with persistence mechanisms where an attacker alters how certain file types are handled to execute malicious code.
Page 1 of 3