Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
160 detections
Filters
Last updated
All Time
Detection languages
68
58
9
8
6
Contributors
35
31
21
19
13
Categories
77
47
32
25
23
Platforms
156
1
1
1
Products / Services
58
43
17
9
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
7
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects potential COM object hijacking leveraging the COM Search Order
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a suspicious or unusual location.
Detects COM object hijacking via TreatAs subkey
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Detects suspicious Powershell code that execute COM Objects
load malicious registered COM objects
Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
load malicious registered COM objects
Detects COM object hijacking via TreatAs subkey
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects potential persistence using Appx DebugPath
Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
Detects potential COM object hijacking leveraging the COM Search Order
Detects potential COM object hijacking where the "Server" (In/Out) is pointing to a suspicious or unusual location.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects potential persistence using Appx DebugPath
Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
Page 7 of 8