Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or modify the security policy. This could indicate an adversary attempting to understand or alter system security configurations for persistence, privilege escalation, or defense evasion.
Detects modifications to various Windows Registry keys under `CurrentVersion` that are commonly used for autostart extensibility points (ASEPs). This includes `Run`, `RunOnce`, `RunOnceEx`, `RunServices`, `RunServicesOnce`, `ShellServiceObjectDelayLoad`, `Policies\System\Shell`, `Policies\Explorer\Run`, `Group Policy\Scripts`, `Explorer\ShellServiceObjects`, `Explorer\ShellIconOverlayIdentifiers`, `Explorer\ShellExecuteHooks`, `Explorer\SharedTaskScheduler`, `Explorer\Browser Helper Objects`, `Authentication\PLAP Providers`, `Authentication\Credential Providers`, and `Authentication\Credential Provider Filters`. Adversaries often modify these keys to establish persistence on a system by ensuring their malicious code executes automatically during system boot or user logon.
Detects modifications to the 'User Shell Folders' registry key, specifically the 'Startup' value. This technique is often used by adversaries to establish persistence by ensuring a malicious payload is launched automatically when a user logs in.
Detects direct modification of autostart extensibility points (ASEP) in the Windows Registry using the 'reg.exe' utility. This rule specifically looks for 'reg.exe' being executed with the 'add' command and targeting common autorun registry paths such as 'Run', 'Userinit', 'Shell', 'Windows', 'User Shell Folders', and 'AlternateShell'. Adversaries often modify these registry keys to establish persistence on a system, ensuring their malicious code executes upon system startup or user login.
This rule detects the creation or modification of Windows Registry Run keys that point to executable files located in suspicious folders. Adversaries often use Run keys for persistence, ensuring their malicious code executes automatically when a user logs in. The rule specifically looks for entries in common Run key paths (e.g., CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) where the associated executable's path is within directories commonly used by malware or temporary files (e.g., PerfLogs, ProgramData, Windows\Temp, AppData\Local\Temp, Recycle.Bin, Users\Default, Users\Public, or user profile subdirectories like Favorites, Music, Documents). A specific exclusion is included for legitimate Windows update processes that might write to temporary folders via RunOnce keys.
Detects modifications to specific registry keys under 'System\CurrentControlSet\Control\Session Manager' that are used for autostart extensibility points (ASEPs). These keys include 'SetupExecute', 'S0InitialCommand', 'KnownDLLs', 'Execute', 'BootExecute', and 'AppCertDLLs'. Adversaries often modify these keys to establish persistence or elevate privileges by ensuring their malicious code runs automatically during system boot or user login.
This rule detects attempts to establish persistence by modifying Windows Registry Run keys to execute PowerShell commands or scripts. It specifically looks for modifications to common Run key paths (CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) that contain keywords indicative of PowerShell execution, such as 'powershell', 'pwsh', 'frombase64string', download functions, hidden window styles, no profile, encoded commands, execution policy bypass, and various Invoke- commands (Invoke-Expression, Invoke-Command, Invoke-WebRequest).
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects PowerShell writing startup shortcuts.
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities
Detects modification of autostart extensibility point (ASEP) in registry.
Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories
Detect modification of the startup key to a path where a payload could be stored to be launched during startup
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.
Detects modification of autostart extensibility point (ASEP) in registry.
Page 54 of 59