Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the creation of a WMI script event consumer by monitoring for the execution of 'scrcons.exe' with 'svchost.exe' as its parent process. This specific process relationship is indicative of WMI persistence mechanisms, where a script event consumer is registered to execute code when certain WMI events occur. Adversaries often leverage WMI event consumers for persistence and privilege escalation.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system and allows users to enable or disable individual handlers. It is extensible, allowing developers to implement and register their own disk cleanup handlers. This rule specifically looks for the creation of new registry keys under 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\' which could indicate a malicious handler being registered for persistence, while filtering out known legitimate default entries.
Detects when the "Index" value of a scheduled task is removed or deleted from the Windows Registry. This action effectively hides the scheduled task from standard tooling like "schtasks /query", making it a defense evasion technique.
This rule detects an unfixed User Account Control (UAC) bypass method in Windows 10 that leverages WSReset.exe. The bypass works by modifying a specific registry key associated with the Windows Store, allowing a low-privilege binary to be executed with elevated privileges when WSReset.exe is run.
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.
Detects when an attacker modifies the registry value associated with the 'hhctrl.ocx' COM object to point to a custom binary. This technique can be used for persistence, as 'hhctrl.ocx' is a legitimate Microsoft HTML Help ActiveX control, and hijacking its registration can lead to arbitrary code execution.
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
Detects function calls from the EditionUpgradeManager COM interface, which is not typically used by standard executables. This activity can be indicative of a User Account Control (UAC) bypass attempt.
Detects the usage of 'wsudo.exe', a Windows Sudo Utility, when it attempts to execute programs with elevated permissions such as 'System' or 'TrustedInstaller'. This tool allows users to run commands with different privileges, which can be abused for privilege escalation.
This rule detects the execution of rundll32.exe with command-line arguments indicative of loading registered COM objects. Specifically, it looks for `rundll32.exe` processes where the command line contains both `{-sta` or `-localserver` and curly braces (`{`, `}`). This pattern is often used by adversaries to achieve persistence or privilege escalation by hijacking COM objects and executing malicious code through them.
This rule detects suspicious activity involving rundll32.exe launching runonce.exe with setupapi.dll and the InstallHinfSection function. This technique can be used by adversaries to achieve persistence by modifying registry run keys or executing arbitrary code via INF files, as setupapi.dll's InstallHinfSection function can call runonce.exe regardless of the INF file's content.
Detects the creation of scheduled tasks by user accounts using the 'schtasks.exe' utility. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' command-line argument, while filtering out activity from common system users to reduce false positives.
This rule detects the creation of new processes where the parent process is `taskmgr.exe`. This activity could indicate an attempt to bypass User Account Control (UAC) by leveraging the Windows Task Manager, which is often auto-elevated. The rule filters out common legitimate processes that `taskmgr.exe` might launch, such as `mmc.exe`, `resmon.exe`, and `Taskmgr.exe` itself, to reduce false positives.
Bypass UAC via CMSTP
Sigma
Detects command-line usage of Microsoft Connection Manager Profile Installer (cmstp.exe) with specific flags often used to install specially formatted local .INF files for privilege escalation or defense evasion. This technique is commonly associated with UAC bypasses.
Detects a User Account Control (UAC) bypass technique that leverages the Event Viewer's RecentViews functionality. This method involves manipulating the RecentViews file to execute arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for command-line arguments that reference 'Event Viewer\RecentViews' or 'EventV~1\RecentViews' in conjunction with a redirection operator ('>'), indicating an attempt to write to or modify this file.
Detects the use of WSReset.exe to bypass User Account Control (UAC). This technique allows adversaries to execute privileged processes without a UAC prompt.
This rule detects unusual parent or child processes associated with `wab.exe` (Windows Contacts) and `wabmig.exe` (Microsoft Address Book Import Tool). These processes are typically not involved in spawning other processes or being spawned by unusual parents. The rule specifically looks for `wab.exe` or `wabmig.exe` being spawned by `WmiPrvSE.exe`, `svchost.exe`, or `dllhost.exe`, or if `wab.exe` or `wabmig.exe` themselves spawn any child processes. This behavior has been observed in connection with Bumblebee loader activity, indicating potential malicious execution or defense evasion.
This rule detects attempts to bypass User Account Control (UAC) by modifying the registry to leverage the DelegateExecute verb. Specifically, it looks for modifications to registry keys ending with '\open\command\DelegateExecute' where the 'Details' field is empty, which is indicative of a fileless UAC bypass technique.
Page 396 of 401