Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects registry key used by Leviathan APT in Malaysian focused campaign
Detects the setting of the DLL that handles the custom protocol handler.
Seen being created by Forest Blizzard APT as reported by MSFT.
Seen being created by Forest Blizzard APT as reported by MSFT.
Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.
Detects suspicious command line reg.exe tool adding key to RUN key in Registry
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Looks for suspicious base64 encoded registry keys being created.
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Detects abusing Windows 10 Narrator's Feedback-Hub
Detects modification of autostart extensibility point (ASEP) in registry.
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects potential PowerShell commands or code within registry run keys
Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Detects potential PowerShell commands or code within registry run keys
Detects suspicious inline VBScript keywords as used by UNC2452
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects suspicious inline VBScript keywords as used by UNC2452
Page 55 of 59