Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the creation of an ActiveScriptEventConsumer via the `wmic.exe` command-line utility. Adversaries often use WMI event subscriptions to establish persistence or elevate privileges by executing malicious code when a specific event occurs. The presence of 'ActiveScriptEventConsumer' and 'CREATE' in the command line indicates an attempt to set up such a subscription.
Detects potential COM object hijacking attempts by monitoring the creation of 'TreatAs' subkeys within the HKU (HKEY_USERS) hive. Adversaries can manipulate the Windows Component Object Model (COM) registry structure to redirect legitimate COM object calls to malicious code, achieving persistence or privilege escalation. This rule specifically looks for the creation of a 'TreatAs' subkey under a CLSID (Class ID) entry, which is a known method for COM hijacking. The rule filters out creations by 'svchost.exe' to reduce false positives, as svchost can legitimately create such keys.
This rule detects attempts to establish persistence or escalate privileges by abusing the Windows 10 Narrator's Feedback-Hub. Specifically, it looks for the deletion of the 'DelegateExecute' value or modification of the '(Default)' value within a specific registry key associated with the Feedback-Hub application. This technique can be used by an attacker to inject a malicious payload that will execute when the Narrator's Feedback-Hub is launched.
Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.
Detects modifications to Internet Explorer's autostart extensibility points (ASEPs) in the Windows Registry. Adversaries may modify these registry keys to establish persistence or elevate privileges by ensuring malicious code executes when Internet Explorer starts or when a user logs in.
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
This rule detects modifications to specific autostart extensibility points (ASEPs) within the `Wow6432Node` path of the Windows registry. These registry keys are commonly used by legitimate applications for persistence, but also by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon user login or system startup. The rule specifically targets modifications under `HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion` for keys like `Run`, `RunOnce`, `ShellServiceObjectDelayLoad`, and various `Explorer` related autostart locations.
This rule detects modifications to the Windows Registry keys responsible for DHCP server Callout DLLs. Attackers can leverage this mechanism to install malicious DLLs that execute in the context of the DHCP server, leading to privilege escalation, persistence, and defense evasion. The rule specifically looks for changes to the 'CalloutDlls' and 'CalloutEnabled' values under the 'HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters' path.
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.
Detects the creation or modification of a Registry Run key specifically for Windows Explorer, where the value points to suspicious locations such as the Recycle Bin, ProgramData, Temp directories, or Public/Default user profiles. This is a common technique used by adversaries to establish persistence on a system, ensuring their malicious code executes upon user login.
Detects potential persistence behavior by monitoring modifications to the Windows TelemetryController registry key. Adversaries can abuse the `CompatTelRunner.exe` binary, which is used by Windows telemetry, to execute arbitrary commands specified in the registry. This rule specifically looks for modifications to the `TelemetryController` subkey where the `Command` value is set to execute common executable file types.
Detects potential DLL sideloading of "DbgModel.dll" when it is loaded from a non-standard or unexpected directory. This rule specifically filters out legitimate loads from common Windows system directories and known application paths like WinDbg and Windows Kits.
This rule detects potential DLL sideloading of "edputil.dll". It specifically looks for instances where "edputil.dll" is loaded from a directory that is not a standard Windows system directory (C:\Windows\System32\, C:\Windows\SysWOW64\, or C:\Windows\WinSxS\). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of the legitimate one.
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. This rule aims to identify instances where this specific DLL is loaded from unexpected or non-standard locations, which could indicate malicious activity such as persistence, defense evasion, or privilege escalation through DLL sideloading.
Detects potential DLL sideloading of "mscorsvc.dll" by identifying instances where this DLL is loaded from a location other than the standard Microsoft .NET Framework or WinSxS directories. This behavior can indicate an attacker attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. This technique can be used for persistence, defense evasion, and privilege escalation.
This rule detects potential DLL sideloading of 'MpSvc.dll'. It specifically looks for instances where 'MpSvc.dll' is loaded from a location other than the legitimate Windows Defender directories or the WinSxS directory. This technique can be used by adversaries to achieve persistence, escalate privileges, or evade defenses by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'rcdll.dll' by monitoring image load events. The rule specifically looks for 'rcdll.dll' being loaded from locations other than standard Microsoft Visual Studio or Windows Kits directories, which are considered legitimate paths for this DLL. This activity can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Page 261 of 401