Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects modifications to various autostart extensibility points (ASEPs) within the Windows Registry's CurrentVersion key. This rule specifically looks for changes to common Run, RunOnce, RunServices, ShellServiceObjectDelayLoad, and other related keys that are frequently abused for persistence and privilege escalation. The rule includes extensive filters for known legitimate software and system processes to reduce false positives.
Detects modifications to specific Windows Registry keys under the `Wow6432Node\Microsoft\Windows NT\CurrentVersion` path, which are commonly used for autostart extensibility points (ASEPs). Specifically, it looks for changes to `Appinit_Dlls` and `Image File Execution Options` which can be abused for persistence or privilege escalation.
This rule detects the creation or modification of a Windows service where the service binary's path is located in a suspicious directory. Adversaries often place malicious service executables in non-standard or temporary locations to evade detection and establish persistence. The rule specifically looks for service image paths containing '\Users\Public\', '\Perflogs\', '\ADMIN$\' or '\Temp\'.
KQL Query from file: 7-Zip CVE-2025-11002 Detection
This rule detects the use of the 'reg.exe' command-line tool to add entries to specific Windows Registry Run keys. These Run keys are commonly used by adversaries to establish persistence, ensuring that a malicious program executes automatically when a user logs in. The rule specifically looks for 'reg.exe' being executed with 'add' command and targeting 'Software\Microsoft\Windows\CurrentVersion\Run', 'Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run', or 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run' registry paths.
This rule detects attempts to establish persistence or escalate privileges by abusing the Windows 10 Narrator's Feedback-Hub. Specifically, it looks for the deletion of the 'DelegateExecute' value or modification of the '(Default)' value within a specific registry key associated with the Feedback-Hub application. This technique can be used by an attacker to inject a malicious payload that will execute when the Narrator's Feedback-Hub is launched.
Detects modifications to Internet Explorer's autostart extensibility points (ASEPs) in the Windows Registry. Adversaries may modify these registry keys to establish persistence or elevate privileges by ensuring malicious code executes when Internet Explorer starts or when a user logs in.
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
This rule detects modifications to specific autostart extensibility points (ASEPs) within the `Wow6432Node` path of the Windows registry. These registry keys are commonly used by legitimate applications for persistence, but also by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon user login or system startup. The rule specifically targets modifications under `HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion` for keys like `Run`, `RunOnce`, `ShellServiceObjectDelayLoad`, and various `Explorer` related autostart locations.
Detects the creation or modification of a Registry Run key specifically for Windows Explorer, where the value points to suspicious locations such as the Recycle Bin, ProgramData, Temp directories, or Public/Default user profiles. This is a common technique used by adversaries to establish persistence on a system, ensuring their malicious code executes upon user login.
Detects direct modification of autostart extensibility point (ASEP) in the Windows Registry using the `reg.exe` utility. This rule specifically looks for the 'add' command within `reg.exe` command lines targeting common Run keys and other autostart locations.
This rule detects the execution of 'runonce.exe' with specific command-line arguments, indicating the execution of a Run Once task as configured in the registry. This is a common method for persistence and defense evasion on Windows systems.
This rule detects modifications to the 'Run Once' registry key, specifically targeting the 'StubPath' value within 'Microsoft\Active Setup\Installed Components'. This registry key is often used by legitimate applications for one-time execution tasks, but adversaries can abuse it to establish persistence or execute malicious payloads. The rule includes filters to exclude common legitimate modifications made by Google Chrome and Microsoft Edge installers, which frequently use this mechanism.
Detects the creation or modification of Windows Run keys by executables located in suspicious directories such as user Downloads, temporary Outlook attachments, or Internet Explorer temporary files. This behavior is often indicative of persistence mechanisms used by malware or adversaries.
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Detects modifications to specific registry keys under the 'Classes' hive that are commonly used as autostart extensibility points (ASEPs). These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring their code executes automatically.
Detects modifications to the WinSock2 Parameters registry keys, specifically within Protocol_Catalog9 and NameSpace_Catalog5 entries. These modifications can be used for persistence by adversaries to load malicious code or redirect network traffic.
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
This rule detects the creation or modification of Windows Registry 'Run' keys that point to executable files located in suspicious directories. Adversaries often use 'Run' keys for persistence, ensuring their malicious code executes automatically when a user logs in. By monitoring these keys for entries pointing to common temporary, user-specific, or system-related folders that are not typically used for legitimate application startup, the rule aims to identify potential malicious persistence mechanisms. The rule includes filters for known legitimate activities, such as Windows Update and Spotify, to reduce false positives.
Detects the modification of the Windows Registry to configure a driver or service to persist and load even when the system is booted into Safe Mode (Minimal or Network). This technique can be used by adversaries to maintain access and execute malicious code in a restricted environment, potentially bypassing security controls that are not active in Safe Mode.
Detects modifications to specific autostart extensibility points (ASEPs) within the Wow6432Node Classes registry path. These registry keys are often abused by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon system startup or user logon.
Page 50 of 59