Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation or modification of Windows Run keys by executables located in suspicious directories such as user Downloads, temporary Outlook attachments, or Internet Explorer temporary files. This behavior is often indicative of persistence mechanisms used by malware or adversaries.
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Detects modifications to specific registry keys under the 'Classes' hive that are commonly used as autostart extensibility points (ASEPs). These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring their code executes automatically.
Detects modifications to the WinSock2 Parameters registry keys, specifically within Protocol_Catalog9 and NameSpace_Catalog5 entries. These modifications can be used for persistence by adversaries to load malicious code or redirect network traffic.
This rule detects attempts to establish persistence by modifying the "DbgManagedDebugger" registry key within the .NET Framework hive. Adversaries can leverage this mechanism to execute a debugger or any specified executable when a .NET application crashes, effectively achieving persistence or privilege escalation. The rule specifically looks for modifications to the 'Debugger' value under the 'Microsoft\.NETFramework\DbgManagedDebugger' key, while filtering out legitimate modifications made by 'vsjitdebugger.exe'.
This rule detects attempts to modify the 'ServiceDll' registry value for the 'wercplsupport' service. This specific modification is associated with the Blue Mockingbird cryptominer, which uses this technique for persistence by hijacking a legitimate service to load its malicious DLL.
This rule detects potential persistence mechanisms leveraging the Appx DebugPath feature in Windows. Adversaries can modify specific registry keys related to Universal Windows Platform (UWP) applications to inject a malicious DebugPath, which then executes their code when the associated application is launched. The rule specifically looks for modifications to the 'DebugPath' value within 'Classes\ActivatableClasses\Package\Microsoft.' registry paths or the default value within '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.' paths.
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
This rule detects the creation or modification of Windows Registry 'Run' keys that point to executable files located in suspicious directories. Adversaries often use 'Run' keys for persistence, ensuring their malicious code executes automatically when a user logs in. By monitoring these keys for entries pointing to common temporary, user-specific, or system-related folders that are not typically used for legitimate application startup, the rule aims to identify potential malicious persistence mechanisms. The rule includes filters for known legitimate activities, such as Windows Update and Spotify, to reduce false positives.
Detects the modification of the Windows Registry to configure a driver or service to persist and load even when the system is booted into Safe Mode (Minimal or Network). This technique can be used by adversaries to maintain access and execute malicious code in a restricted environment, potentially bypassing security controls that are not active in Safe Mode.
Detects potential DLL sideloading of 'roboform.dll' or 'roboform-x64.dll' when loaded by an executable that is not the legitimate RoboForm application (robotaskbaricon.exe or robotaskbaricon-x64.exe) or is loaded from an unexpected path outside of the standard RoboForm installation directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "ShellDispatch.dll" by monitoring image load events. The rule specifically looks for instances where 'ShellDispatch.dll' is loaded from locations other than typical legitimate temporary directories (like ':\Users\*\AppData\Local\Temp\' or ':\Windows\Temp\'), which could indicate malicious activity.
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. This rule specifically looks for the loading of 'SmadHook32c.dll' or 'SmadHook64c.dll' by any process other than the legitimate SmadAV executables ('SmadavProtect32.exe' or 'SmadavProtect64.exe') from their expected installation paths.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
Detects the execution of 'regsvr32.exe' attempting to load a DLL with an uncommon or unrecognized file extension. This behavior is often associated with defense evasion techniques where adversaries use legitimate Windows binaries to proxy execution of malicious code, bypassing application whitelisting or other security controls.
Detects the creation of scheduled tasks using 'schtasks.exe' that are configured to run only once and involve a temporary folder in their command line. This behavior can be indicative of an adversary establishing temporary persistence or execution mechanisms, often seen in post-exploitation activities.
Detects the creation of a scheduled task that uses PowerShell to retrieve and execute a payload stored in the Windows Registry. This technique is often used for persistence and privilege escalation by malware like Qbot.
Detects the creation of scheduled tasks using `schtasks.exe` where the command line arguments include names of common Windows system processes. This behavior can indicate an adversary attempting to masquerade a malicious scheduled task as a legitimate system process for persistence or privilege escalation.
This rule detects the use of 'fodhelper.exe' as a parent process. Fodhelper.exe is a legitimate Windows utility that can be abused to bypass User Account Control (UAC) and execute processes with elevated privileges without prompting the user. Adversaries commonly leverage this technique for privilege escalation and defense evasion.
Detects modifications to specific autostart extensibility points (ASEPs) within the Wow6432Node Classes registry path. These registry keys are often abused by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon system startup or user logon.
Page 263 of 401