Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
14
3
2
1
Contributors
5
3
3
2
2
Categories
6
6
5
4
4
Platforms
14
3
3
2
Products / Services
5
3
2
2
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects modifications to Windows Registry keys associated with persistence techniques, including LSA authentication package registration, custom credential provider registration, and manipulation of SafeBoot registry keys.
Detects modifications to the 'Authentication Packages' registry key that include a DLL, which can be used for persistence by adversaries. The Local Security Authority (LSA) process loads these DLLs at system startup.
Detects the modification or creation of registry values under the Windows Local Security Authority (LSA) configuration key, specifically targeting the 'Authentication Packages' or 'Security Packages' values. Adversaries often use these registry locations to inject custom DLLs that are loaded by the LSA process (lsass.exe) at system boot for persistence or credential dumping.
Detects the modification or creation of registry values under the Windows Local Security Authority (LSA) configuration key, specifically targeting the 'Authentication Packages' or 'Security Packages' values. Adversaries often use these registry locations to inject custom DLLs that are loaded by the LSA process (lsass.exe) at system boot for persistence or credential dumping.
Detects modifications to the 'Authentication Packages' registry key that include a '.dll' file. Adversaries may abuse authentication packages to execute DLLs when the system boots, establishing persistence and potentially escalating privileges.
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
Detects registration of malicious authentication packages for credential capture
Detects modification of domain controller authentication packages
This rule detects network traffic to port 445 (SMB) containing the case-insensitive string "Authentication Packages". This string is often associated with the registration of malicious authentication package DLLs via the Windows Registry, a technique used for persistence and credential access. The rule specifically looks for this content in established TCP connections flowing to the home network.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects the legitimate 'steam_monitor.exe' loading 'crashhandler.dll' from a non-standard directory like ProgramData. This side-loading technique was observed in campaigns delivering Korplug/GreedyRobin malware, often following initial access via OAuth redirection abuse.
Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Fortigate Belsen Leak KQL Check
KQL Query from file: Entra QR Code Sign-In KQL Detection
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
This query shows details about all approved Entra ID Governance Access Packages assignments. The results include the time the request was created and approved along with the justification text provided by the requestor and the approver.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
