Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,875
5,151
4,864
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects the modification of Image File Execution Options (IFEO) registry keys for critical Windows accessibility tools (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Attackers often abuse this technique to establish persistence or execute arbitrary code with elevated privileges by replacing or hijacking these tools, a behavior associated with ransomware like TrymeLocker.
This rule detects the creation or modification of a 'Debugger' registry value under the 'Image File Execution Options' (IFEO) key for the process 'agntsvc.exe'. This technique is commonly used by adversaries to establish persistence or intercept process execution by forcing an arbitrary executable to run whenever the target process is started.
Detects a registry modification where the Image File Execution Options (IFEO) 'Debugger' value for the agent service process 'agntsvc.exe' is set to 'Systray.exe'. This technique is used by the Pay2Key ransomware to hijack the process execution flow, potentially to impair security or backup services.
Detects a registry modification where Pay2Key ransomware sets the 'shutdownwithoutlogon' value to 0 under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. This action disables the shutdown option in the Windows Start menu, a tactic used by the ransomware to maintain access to the infected system and ensure encryption processes are not interrupted by a reboot.
Detects the creation or modification of a 'Debugger' registry value for the 'agntsvc.exe' process within 'Image File Execution Options'. This technique allows an attacker to automatically execute a specified binary (in this case, 'Systray.exe') whenever the target process is invoked, providing a mechanism for persistence or privilege escalation.
Detects Pay2Key ransomware establishing persistence by modifying Windows registry Run keys to execute a file named 'browser.exe' located within a GUID-named subdirectory inside the user's AppData\Local folder. This behavior is indicative of multi-stage SFX archive deployment.
Detects OpenVPN Connect applying a server-controlled PAC AutoConfigURL to HKCU Internet Settings, potentially enabling proxy interception of user traffic. This is achieved when a malicious VPN server pushes a dhcp-option PROXY_AUTO_CONFIG_URL, causing the OpenVPN system-level agent to write the attacker-controlled URL to the user's registry hive.
Detects suspicious Registry modifications made by scripting hosts (wscript.exe, cscript.exe) often associated with malware persistence. This includes unauthorized modifications to Winlogon shell keys, addition of known malicious script names to Run keys, installation of scripts into startup paths, and Image File Execution Options (IFEO) debugger hijacking for cmd.exe.
This rule detects potential persistence mechanisms by monitoring modifications to specific Windows registry keys. It looks for the creation or modification of 'Image File Execution Options' (IFEO) debugger keys, which can be used to hijack process execution, and specific 'Run' keys that could be used for unauthorized startup execution. The rule focuses on these activities when initiated by script interpreters like wscript.exe or cscript.exe.
Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.
Detects modifications to Windows Update registry keys (AUOptions or NoAutoUpdate) by non-Microsoft signed processes. Adversaries may use this to disable automatic security updates, preventing the installation of critical patches to maintain a persistent, vulnerable environment.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
This rule detects potential registry enumeration activities targeting sensitive Windows system keys ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' or 'HKLM\HARDWARE\DESCRIPTION') that are associated with the execution of suspicious processes named 'systemki.exe' or 'sysklnd.exe'. These filenames are consistent with historical observations of the Sauron (also known as Strider) malware framework.
This rule detects modifications to specific Windows Registry keys used for keyboard layout remapping ('Scancode Map') or mouse button swapping ('SwapMouseButtons'). Such modifications can be used by adversaries to facilitate keylogging, persistent input redirection, or to impair user interaction. The rule prioritizes alerts where the change was initiated by script engines like wscript.exe or cscript.exe, which are common vectors for VBScript-based malware.
Detects unauthorized modifications to the Image File Execution Options (IFEO) registry keys for 'cmd.exe'. The rule specifically looks for the 'Debugger' value being set to script-based interpreters (e.g., .vbs, .js, wscript, cscript), a technique known to be used by LCRYX ransomware to intercept security tool execution and establish persistence.
This rule detects unauthorized modifications to common Windows persistence registry keys, including 'Run' keys, the 'Winlogon Shell' value, and 'Image File Execution Options' (IFEO) debugger values. These modifications are commonly used by adversaries to establish persistence or intercept process execution.
Detects a single parent process launching registry or PowerShell queries for both Defender PUA policy and Windows product edition within a ten-minute window. This behavior can indicate malware attempting to understand its environment and potentially evade detection or tailor its execution.
This rule detects persistence mechanisms associated with the Turla STOCKSTAY backdoor. It monitors for the creation or modification of Registry Run keys, the execution of msiexec for suspicious MSI package installations (DiplomacyEduAI.msi, Copia.msi), and the presence of known STOCKSTAY component executables (e.g., MicrosoftUpdateOneDrive.exe, SMEditor.exe) in the %LOCALAPPDATA%/Programs/SMN/ directory.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects modifications to the Windows QoS Group Policy registry hive, which can be used as a persistence mechanism for EDR throttling or other malicious purposes. This rule specifically looks for any registry events within the 'SOFTWARE\Policies\Microsoft\Windows\QoS' path.
Detects registry modifications to SyncRootManager occurring alongside cldflt.sys activity, which may indicate manipulation of cloud synchronization roots.
Page 33 of 53