Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
21
10
8
5
3
Contributors
22
9
6
5
3
Categories
28
24
14
9
6
Platforms
52
2
2
2
2
Products / Services
25
17
7
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects modifications to Windows Registry auto-start keys (Run, RunOnce, Winlogon, or Services) by suspicious processes (e.g., script interpreters, shell, or office applications) or processes running from temporary directories, where the registry value points to paths commonly used by adversaries (AppData, Temp, or ProgramData).
Detects modifications to Windows Registry persistence locations (Run, RunOnce, Winlogon Shell/Userinit) where the assigned executable path is located within high-risk directories such as Temp, AppData, or Users Public folders. This is a common technique used by malware for persistence.
Detects modifications to Windows Registry persistence locations (Run, RunOnce, Winlogon Shell/Userinit) where the assigned executable path is located within high-risk directories such as Temp, AppData, or Users Public folders. This is a common technique used by malware for persistence.
Detects persistence attempts on Windows by monitoring for modifications to common Registry Run/RunOnce keys or the creation of executable files within the user startup directory. The rule excludes common legitimate processes like msiexec.exe, trustedinstaller.exe, and explorer.exe to minimize false positives.
Detects persistence attempts by monitoring modifications to Windows registry run keys (Run, RunOnce, Winlogon Shell/Userinit) or file creation within the Startup folder. It alerts when these locations are updated to reference suspicious file paths (Temp/AppData) or execute scripts (vbs, ps1, js, wsf, bat, hta).
This rule identifies potential persistence activity on a Windows host by correlating multiple indicators such as service creation, scheduled tasks, registry run key modifications, Winlogon helper modifications, and driver loading. It specifically monitors for indicators associated with 'NetSupport' or 'client32' filenames or services. The rule triggers when two or more distinct persistence mechanisms are detected for the same host and user.
Detects signs of NetSupport Manager (client32.exe) establishing multiple persistence mechanisms simultaneously or in quick succession, including Windows service creation, Winlogon helper registration, Registry Run key modification, scheduled task creation, and keyboard filter driver installation. This behavior is indicative of unauthorized use of remote access tools to maintain persistence on a host.
Detects persistence attempts related to the NetSupport Manager remote access tool by monitoring modifications to Windows Registry keys associated with run keys, Winlogon notification packages, and services.
This rule detects various persistence mechanisms associated with the NetSupport Manager remote access tool. It monitors for the creation of services, scheduled tasks, registry modifications (such as Run keys, Winlogon Notify packages, and keyboard filter drivers), and process executions related to NetSupport Manager (specifically client32.exe).
Detects modifications to the Winlogon Shell or Userinit registry keys. These keys are commonly used by adversaries for persistence to execute malicious binaries or scripts upon user logon.
Detects potential persistence attempts by monitoring suspicious modifications to Windows Winlogon registry keys, specifically targeting Shell, Userinit, GinaDLL, and Notify subkeys associated with the TOKYOCORE malware.
Generic rule content from file: TOKYOCORE Winlogon Hijack: Userinit/Shell, Notify DLL, Forced Auto-Logon
Detects modifications to the Windows Registry 'Userinit' value under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'. Adversaries may modify this value to execute arbitrary malicious code automatically during user logon, establishing persistence.
Detects modifications to the 'HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell' registry value. Attackers often modify this value to execute arbitrary malicious binaries or scripts upon user logon as a persistence mechanism, replacing the default 'explorer.exe'.
Detects modifications to the Windows Registry 'Winlogon\Userinit' key where the value contains double commas. This pattern is commonly used by attackers to append a malicious executable or script path to the legitimate 'userinit.exe' process, causing the malicious code to execute during every system startup or user logon.
Detects suspicious modifications to Windows registry keys associated with logon script execution, such as 'UserInitMprLogonScript' or 'Userinit'. These locations are frequently abused by adversaries to achieve persistence by forcing the execution of malicious scripts or binaries upon user logon. The rule excludes modifications made by standard Microsoft Windows processes to reduce noise.
This rule detects modifications to the Winlogon Shell registry key or a specific 'MyStartupScript' registry Run key. These locations are commonly abused by the LCRYX ransomware to establish persistence via VBScript or script host execution. The rule monitors both EDR registry events and Sysmon event ID 13 for suspicious changes performed by script host processes or targeting these specific persistence locations.
Detects modifications or creations of registry values within common Windows auto-start locations, specifically the 'Run' and 'Winlogon' keys. These locations are frequently abused by adversaries to maintain persistence on a host. The rule excludes common, legitimate installer and administration processes to reduce noise.
Detects modification of Winlogon registry keys for DLL persistence
Detects registry run key and logon persistence modifications commonly used by the StrikeShark campaign. This rule monitors for entries in standard Windows autorun registry keys and Winlogon persistence locations where the associated file path is located in user-writable directories (AppData, Temp, Public) or contains suspicious file extension patterns, which are indicative of malware such as Sharkloader.
Detects modification of the Windows Registry 'Shell' value within the Winlogon key to an executable other than 'explorer.exe'. This technique is commonly used by malware, such as TrymeLocker, to achieve persistence by replacing or augmenting the default Windows shell with a malicious payload that executes upon every user login.
Page 1 of 3