Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
7
5
1
1
Contributors
3
3
2
2
2
Categories
7
3
3
2
2
Platforms
9
3
2
1
Products / Services
4
3
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
Detects registration of malicious SSP DLLs for credential interception
This rule detects network traffic on TCP port 445 (SMB) containing the string "Security Packages" in a case-insensitive manner. This pattern is often associated with the registration or use of Security Support Provider DLLs, which can be a persistence mechanism (T1547.005) used by adversaries to maintain access to a system.
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
Detects the addition of a Security Support Provider (SSP) to the Windows registry. When an SSP DLL is loaded into the Local Security Authority (LSA) process, typically upon system reboot or via an API call, it gains access to encrypted and plaintext passwords stored in Windows. This technique is often used for persistence and credential access.
KQL Query from file: Azure AI Security Finding Report
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Tracking The Most Dangerous Entra Admin Role
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
The following query surface network activity associated with exploitation of CVE-2022-22965.
The following analytic identifies command-line activity querying the registry for Security Support Providers (SSPs) related to Local Security Authority (LSA) protection and configuration. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on processes accessing specific LSA registry paths. Monitoring this activity is crucial as adversaries and post-exploitation tools like winpeas may use it to gather information on LSA protections, potentially leading to credential theft. If confirmed malicious, attackers could exploit this to scrape password hashes or plaintext passwords from memory, significantly compromising system security.
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.