Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
490 detections
Filters
Last updated
All Time
Detection languages
406
57
13
12
1
Contributors
387
54
19
12
8
Categories
142
104
64
45
34
Platforms
385
30
19
18
13
Products / Services
205
136
62
40
27
MITRE Techniques
18,079
15,542
12,519
8,344
6,154
CVEs
2
1
Detects the presence of a registry key created during Azorult execution
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
Detects actions caused by the RedMimicry Winnti playbook
Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
Detects setting of a new registry value related to BgInfo configuration, which can be abused to execute custom VBScript via "BgInfo.exe"
Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events.
Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.
Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.
Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing.
Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)
Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel
Detects disabling Windows Defender Exploit Guard Network Protection
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings
Detect change of the user account associated with the FAX service to avoid the escalation problem.
Change the Fax Dll
Sigma
Detect possible persistence using Fax DLL load when service restart
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
Detects potential persistence activity via outlook today page.
An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
Detects tampering with attachment manager settings policies attachments (See reference for more information)
Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging
Page 18 of 24