Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
67 detections
Filters
Last updated
All Time
Detection languages
41
7
5
4
4
Contributors
41
9
8
3
2
Categories
28
17
15
11
10
Platforms
52
7
4
3
2
Products / Services
10,665
9,758
6,692
4,418
3,749
MITRE Techniques
21
19
19
15
14
CVEs
3
3
2
1
The following analytic detects a modification to the Windows registry setting "LongPathsEnabled," which allows file paths longer than 260 characters. This detection leverages data from the Endpoint.Registry datamodel, focusing on changes to the specific registry path and value. This activity is significant because adversaries, including malware like BlackByte, exploit this setting to bypass file path limitations, potentially aiding in evasion techniques. If confirmed malicious, this modification could facilitate the execution of long-path payloads, aiding in persistence and further system compromise.
The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" path. This activity is significant as it was observed in the Hermetic Wiper malware, indicating potential malicious intent to alter file attributes and user interface elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities.
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. This activity can be indicative of an adversary attempting to steal authentication certificates for various malicious purposes, including lateral movement, persistence, or privilege escalation.
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
Page 4 of 4