Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
73 detections
Filters
Last updated
All Time
Detection languages
21
21
9
8
5
Contributors
30
9
6
4
4
Categories
43
26
25
20
18
Platforms
72
1
Products / Services
24
15
14
2
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
1
IDS Protocols
1
Detects the creation of scheduled tasks named 'RageGuard' or utilizing 'win_guard' binary paths in suspicious directories (Temp, AppData, ProgramData), correlated with concurrent registry modifications to Winlogon (Shell/Userinit) or Image File Execution Options (Debugger) using the same binary, indicative of the TrymeLocker ransomware persistence mechanism.
Detects the creation or modification of the 'Debugger' registry value under the 'Image File Execution Options' (IFEO) key. This technique is often used by adversaries to establish persistence, achieve privilege escalation, or hijack the execution of specific applications, including security tools.
Detects the creation of Image File Execution Options (IFEO) registry entries that associate a debugger with common security-related or monitoring binaries (e.g., Sysmon, SetACL, Filebeat). Attackers use this technique to hijack the execution flow of these security tools, effectively disabling or impairing their functionality (a form of defense evasion).
Detects modifications to the Windows Image File Execution Options (IFEO) registry key where a debugger value is configured to point to scripting engines like VBScript or Windows Script Host (wscript/cscript). This technique is commonly used for persistence or to intercept process execution by forcing the execution of scripts when legitimate applications are launched.
Detects unauthorized modifications to common Windows persistence registry keys, including Winlogon shell/userinit hijacking, Image File Execution Options (IFEO) debugger abuse, and known malicious Run key entries.
This rule detects unauthorized modifications to the Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Adversaries often replace or redirect these binaries to execute arbitrary code (often a backdoor or persistent access tool) with high privileges, typically triggered at the Windows login screen. The rule specifically looks for a 'debugger' registry value containing 'win_guard_'.
Detects the modification of Image File Execution Options (IFEO) registry keys for Windows accessibility binaries (e.g., sethc.exe, utilman.exe). Adversaries frequently use this technique to hijack these binaries to launch a command shell with SYSTEM privileges when triggered from the login screen.
This rule detects attempts to establish persistence for 'vds.exe' (Virtual Disk Service) by modifying the Image File Execution Options (IFEO) registry key to point its debugger to an executable located within the Windows Fonts directory. This technique is often used by adversaries to maintain access or elevate privileges, as the Fonts directory is typically writable by standard users and can be used to hide malicious executables.
Identifies the EDR killer modifying the Image File Execution Options (IFEO) registry keys to silently attach a debugger (like systray.exe) to EDR components, effectively blinding them.
Detects execution of rundll32.exe with 'phsvc' command line arguments, and the subsequent spawning of potentially malicious child processes (cmd, powershell, wscript, mshta, calc) from the SystemInformer.exe process. This behavior indicates potential abuse of the PhSvcApiCreateProcessIgnoreIfeoDebugger functionality within SystemInformer to bypass debugger-related detection or gain unauthorized execution context.
Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.
Detects modifications to Windows Registry keys associated with Image File Execution Options (IFEO) or Silent Process Exit, which are techniques commonly abused by adversaries to hijack execution flow for persistence or privilege escalation. The rule monitors for the creation or modification of 'Debugger', 'GlobalFlag', 'MonitorProcess', or 'ReportingMode' values, excluding known legitimate debuggers.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects the modification of Image File Execution Options (IFEO) registry keys for critical Windows accessibility tools (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Attackers often abuse this technique to establish persistence or execute arbitrary code with elevated privileges by replacing or hijacking these tools, a behavior associated with ransomware like TrymeLocker.
This rule detects the creation or modification of a 'Debugger' registry value under the 'Image File Execution Options' (IFEO) key for the process 'agntsvc.exe'. This technique is commonly used by adversaries to establish persistence or intercept process execution by forcing an arbitrary executable to run whenever the target process is started.
Detects a registry modification where the Image File Execution Options (IFEO) 'Debugger' value for the agent service process 'agntsvc.exe' is set to 'Systray.exe'. This technique is used by the Pay2Key ransomware to hijack the process execution flow, potentially to impair security or backup services.
Detects the creation or modification of a 'Debugger' registry value for the 'agntsvc.exe' process within 'Image File Execution Options'. This technique allows an attacker to automatically execute a specified binary (in this case, 'Systray.exe') whenever the target process is invoked, providing a mechanism for persistence or privilege escalation.
Detects modifications to the Windows Registry's Image File Execution Options (IFEO) to inject a debugger for 'agntsvc.exe'. This technique is used by Pay2Key ransomware to hijack and suppress backup agent services, preventing them from functioning during the encryption process.
Detects suspicious Registry modifications made by scripting hosts (wscript.exe, cscript.exe) often associated with malware persistence. This includes unauthorized modifications to Winlogon shell keys, addition of known malicious script names to Run keys, installation of scripts into startup paths, and Image File Execution Options (IFEO) debugger hijacking for cmd.exe.
This rule detects potential persistence mechanisms by monitoring modifications to specific Windows registry keys. It looks for the creation or modification of 'Image File Execution Options' (IFEO) debugger keys, which can be used to hijack process execution, and specific 'Run' keys that could be used for unauthorized startup execution. The rule focuses on these activities when initiated by script interpreters like wscript.exe or cscript.exe.
Detects unauthorized modifications to the Image File Execution Options (IFEO) registry keys for 'cmd.exe'. The rule specifically looks for the 'Debugger' value being set to script-based interpreters (e.g., .vbs, .js, wscript, cscript), a technique known to be used by LCRYX ransomware to intercept security tool execution and establish persistence.
Page 2 of 4