Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Looking for strings entered into and executed from the Windows run box, which is leveraged by ClickFix campaigns for initial access.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
This detection scenario focuses on the abuse of legacy .pif (Program Information File) extensions for malware delivery, execution, and persistence on Windows endpoints. Attackers may use .pif files, sometimes with deceptive double extensions or in user-writable folders, to execute arbitrary code, evade user scrutiny, or persist via the registry, exploiting the fact that .pif files are still natively executable on modern Windows systems.
Algorithm:
- Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths).
- Detect execution of any .pif file in user-writable folders.
- Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process.
- Detect registry persistence attempts (Run/RunOnce) by .pif processes.
- Suppress false positives by excluding known dev/test folders and processes.
Algorithm:
- Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths).
- Detect execution of any .pif file in user-writable folders.
- Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process.
- Detect registry persistence attempts (Run/RunOnce) by .pif processes.
- Suppress false positives by excluding known dev/test folders and processes.
Detects a wide range of indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with SafePay ransomware, including specific command lines, persistence mechanisms, defense evasion techniques, and host-based artifacts.
This detection identifies attempts to establish persistence by modifying known Windows startup registry keys. These keys control which programs are automatically executed during system boot or user logon and are frequently abused by adversaries to maintain access across reboots.
Analysts will need to tune the rule through testing and using the exclusion statements to remove noise of what is known good within their environments.
Analysts will need to tune the rule through testing and using the exclusion statements to remove noise of what is known good within their environments.
KQL Query
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query
KQL Query from file: Detecting EDR-killing Tool
KQL Query
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query from file: TA4557 drops More_Eggs
Detects potential PowerShell commands or code within registry run keys
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
KQL Query from file: Seashell Blizzard (IRIDIUM) - PWS:Win64-HighCount
Detects the creation or modification of a registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, a common persistence mechanism used by DarkCloud Stealer.
KQL Query
Detects modifications to specific registry keys under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). This includes keys related to Terminal Services, Security Providers, Safe Boot, Print Monitors/Providers, Network Provider Order, and LSA Authentication/Notification Packages. Such modifications can be indicative of persistence mechanisms used by adversaries.
Page 53 of 59