Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects modification of autostart extensibility point (ASEP) in registry.
Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_bear_activity_gtr19.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
Detects the setting of a custom protocol handler with the name "rogue".
Seen being created by Forest Blizzard APT as reported by MSFT.
Seen being created by Forest Blizzard APT as reported by MSFT.
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.
Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
MosaicLoader
KQL
This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection
Looks for suspicious addition of command interpreters to windows registry.
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Use this query to locate persistence in Startup with HTA files.
Detects Ryuk ransomware activity
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.
Detects abusing Windows 10 Narrator's Feedback-Hub
Detects modification of autostart extensibility point (ASEP) in registry.
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
Detects modification of autostart extensibility point (ASEP) in registry.
Page 56 of 59