Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
13
5
4
3
3
Contributors
7
5
5
5
2
Categories
14
12
11
7
5
Platforms
31
3
Products / Services
9
9
9
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
3
IDS Protocols
3
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
Detects the persistence and execution mechanism of the Lunex Native Messaging Host backdoor. The rule identifies the registration of the 'com.lunex.explorer' native messaging host registry key and the subsequent invocation of PowerShell scripts from browser processes (chrome.exe or msedge.exe) containing specific backdoor command arguments like 'list_drives' or 'run'.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
Detects modifications or creation of 'StubPath' registry values within the 'Active Setup\Installed Components' registry key, where the value points to suspicious, user-writable directories. This technique is commonly used to establish persistence by executing a malicious file upon user logon.
Detects use of Active Setup registry keys for per-user program execution on login
Detects the modification of registry keys within the Active Setup 'Installed Components' path, specifically targeting keys named '{RAGE-MASTER}'. The rule flags the creation or modification of a 'StubPath' value or any value containing 'win_guard_' or 'RageCore_', which are typical indicators of persistence mechanisms used by malware to execute code upon user logon.
Detects modifications to the 'StubPath' registry value within the 'Active Setup\Installed Components' registry hive. Adversaries use this mechanism to achieve persistence by forcing the execution of arbitrary code when a user logs in.
Detects the creation or modification of Windows Active Setup registry keys ('StubPath') used by TrymeLocker to achieve persistence. The rule monitors for keys pointing to executables in suspicious locations such as Windows Temp, Users Public, ProgramData, or AppData, and identifies specific threat-related patterns like 'win_guard_', 'RageCore_', and '{RAGE-MASTER}'.
Detects a coordinated persistence effort by a single process, involving the creation of a scheduled task, modification of the HKCU Run registry key, and modification of the Active Setup registry key within a 5-minute window. This behavior is indicative of a complex persistence mechanism typically associated with malicious software.
Detects modifications or creation of 'StubPath' registry values within the 'Active Setup\Installed Components' registry key, where the value points to suspicious, user-writable directories. This technique is commonly used to establish persistence by executing a malicious file upon user logon.
Detects network traffic containing 'Active Setup', 'Installed Components', and 'StubPath' strings, which are indicative of a potential attempt to reference or trigger a malicious StubPath registry key for persistence.
Detects network traffic containing 'Active Setup', 'Installed Components', and 'StubPath' strings, which are indicative of a potential attempt to reference or trigger a malicious StubPath registry key for persistence.
Detects potential persistence attempts by TrymeLocker malware, specifically monitoring for malicious StubPath values written to Active Setup registry keys. The rule correlates this behavior with other indicators of compromise such as malicious Debugger values set within Image File Execution Options (IFEO) keys or suspicious service creation, effectively identifying high-confidence persistence activity.
Detects modifications to Windows Active Setup registry keys involving suspicious StubPath values or the creation of the specific {RAGE-MASTER} registry key associated with TrymeLocker malware. This technique is used to maintain persistence by executing malicious code upon user login.
This rule detects network traffic patterns indicative of an attempt to use the 'Active Setup' registry key for persistence. Specifically, it looks for TCP traffic on port 445 (commonly used for SMB/CIFS) directed to the home network, containing the strings 'Active Setup' and 'StubPath' (case-insensitive). This combination suggests an attacker might be trying to establish persistence by modifying the 'StubPath' value within an 'Active Setup' registry key, which Windows uses to run commands during user logon.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Page 1 of 2