Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects potential Ryuk ransomware activity by looking for specific command-line patterns. This includes attempts to establish persistence via the Run registry key, deletion of backup files, and stopping critical services using 'net stop' commands.
This rule detects persistence mechanisms used by the Kapeka backdoor. It specifically looks for the creation of a scheduled task named "Sens Api" (or "OneDrive" in some cases) via `schtasks.exe` set to run on system startup, or the addition of an autorun registry entry named "Sens Api" under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` via `reg.exe`. Both persistence methods are identified by their command lines calling `rundll32` with a `.wll` file and the export ordinal `#1`.
Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.
Detects PowerShell writing shortcut (.lnk) files into the Windows startup directory. This technique is commonly used by adversaries to establish persistence, ensuring their malicious code executes each time a user logs in. The rule specifically looks for PowerShell (powershell.exe or pwsh.exe) as the process creating these shortcut files in the 'Start Menu\Programs\Startup' path.
This rule detects when a file is written to the Windows startup directory. This activity is a common technique used by adversaries to establish persistence on a system, ensuring that their malicious code executes automatically when a user logs in or the system boots. The rule specifically looks for file creation events where the target filename contains the path to the 'Start Menu\Programs\StartUp' directory. It includes filters to reduce false positives from legitimate system processes like Windows Update and Microsoft OneNote.
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.
This rule detects attempts to obfuscate the `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` registry key path by inserting various special characters between the letters. This technique is often used by malware to establish persistence and evade detection.
Detects the creation or modification of a custom protocol handler in the Windows Registry with the name "rogue" and a specific CLSID. This activity has been observed as a persistence mechanism used by the Forest Blizzard APT group (also known as Star Blizzard or COLDRIVER). By setting a custom protocol handler, the adversary can execute arbitrary code when a specially crafted URI is accessed.
Detects the setting of a DLL that handles a custom protocol handler, specifically targeting a CLSID observed in attacks attributed to Forest Blizzard APT. This technique can be used for persistence or privilege escalation by registering a malicious DLL to be loaded when a specific protocol is invoked.
Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.
Detects changes to the "Winlogon" registry key where a process sets the "Shell" value to a string containing specific PowerShell commands observed in KamiKakaBot samples. This technique is used to achieve persistence by executing a malicious script during user logon.
Detects msdt.exe creating files in suspicious directories, which could indicate exploitation of vulnerabilities like Follina (CVE-2022-30190) or Dogwalk. The rule specifically looks for file creations in common startup locations, public user directories, or system logs directories.
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Detects the execution of the hacktool SharPersist, which is used to deploy various persistence mechanisms on Windows systems. The rule specifically identifies SharPersist.exe being executed with command-line arguments indicative of creating scheduled tasks, modifying startup folders, adding registry run keys, or installing new services for persistence.
Detects modifications to registry keys associated with Microsoft Office add-ins, which can be used for persistence. Adversaries may abuse these autostart extensibility points (ASEPs) to execute malicious code every time an Office application starts.
Detects the setting of a new value in the Windows Registry Run key that is used by the Kapeka backdoor for persistence. Specifically, it looks for entries in `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` that end with `\Sens Api` or `\OneDrive` and contain `rundll32.exe`, `.wll`, and `#1` in their details, which are indicators of Kapeka's persistence mechanism.
Detects the setting of a registry value within the `\Shell\Open\Command` key using PowerShell classes from the `System.Security.Cryptography` namespace. This technique can be used by adversaries for defense evasion, for example, to decrypt malicious payloads on the fly.
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. The rule specifically looks for `wmic.exe` or `wmiprvse.exe` as a parent process, executing `reg.exe add` commands to modify `Run` registry keys, and targeting suspicious file paths commonly used by malware for persistence.
Detects VBScript content stored into registry keys, specifically targeting the 'Software\Microsoft\Windows\CurrentVersion' path, which is often used for persistence. The rule looks for keywords indicative of VBScript or JScript execution, such as 'vbscript:', 'jscript:', 'mshtml,', 'RunHTMLApplication', 'Execute(', 'CreateObject', and 'window.close'. It explicitly filters out legitimate MSIEXEC activity related to .NET installations in specific registry paths to reduce false positives. This activity has been observed in campaigns by groups like UNC2452.
Detects modifications to specific autostart extensibility points (ASEPs) within the Windows Registry's Session Manager key. These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring malicious code is executed during system boot or user logon. The rule specifically targets changes to 'SetupExecute', 'S0InitialCommand', 'KnownDlls', 'Execute', 'BootExecute', and 'AppCertDlls' values under the 'System\CurrentControlSet\Control\Session Manager' path.
Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.
Page 49 of 59