Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
8
7
1
1
1
Contributors
5
4
3
2
1
Categories
10
9
5
3
2
Platforms
18
1
Products / Services
6
2
1
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
1
IDS Protocols
1
Detects AppInit DLL registry modifications referencing DLLs located in user-writable directories (such as AppData, Temp, Users\Public, or Downloads), which may indicate adversary persistence or process injection configuration.
Detects modifications to the 'LoadAppInit_DLLs' or 'RequireSignedAppInit_DLLs' registry values within the 'Windows NT\CurrentVersion\Windows' key. This technique is often used for persistence or to force-load a malicious DLL into processes that load user32.dll.
Detects modifications to the AppInit_DLLs or LoadAppInit_DLLs registry values. These values are used to force the loading of specified DLLs into every process that loads user32.dll, a technique used by adversaries for persistence and code injection.
Detects potential supply-chain attack activity related to IronWorm, including modifications to the AppInit_DLLs registry key and the execution of Windows utility binaries (regsvcs.exe, regasm.exe, InstallUtil.exe) by npm or node processes, which are commonly abused to facilitate malicious code execution during package installation.
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Detects AppInit_DLLs registry modification for persistent DLL injection
This rule detects network traffic on TCP port 445 (SMB) containing the string "AppInit_DLLs" case-insensitively. This string is associated with the AppInit_DLLs mechanism in Windows, which can be abused for process injection and persistence by loading arbitrary DLLs into user-mode processes. The rule specifically looks for this string in traffic flowing to the server on an established connection.
Detects use of Office Test registry key for persistent DLL loading
This rule detects modifications to the AppInit_DLLs registry key, which can be used by adversaries to establish persistence or elevate privileges. DLLs specified in this key are loaded by user32.dll into nearly every process that loads user32.dll. The rule specifically looks for changes to the 'AppInit_Dlls' value within the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows' and 'HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows' registry paths, excluding empty values.
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
Detects the modification of the 'Ime File' registry value within the 'Keyboard Layouts' key to include an uncommon file extension. This technique can be used by attackers to load a malicious DLL into a process via the Windows Input Method Editor (IME) feature, typically after sending a WM_INPUTLANGCHANGEREQUEST message. The rule specifically looks for modifications where the 'Ime File' value does not end with the standard '.ime' extension, indicating potential malicious activity.
Detects changes to the "AutodialDLL" registry key, which can be used as a persistence method to load custom DLLs via the "ws2_32" library. This technique allows an attacker to execute malicious code every time a process loads the Winsock2 library.
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.