Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,875
5,151
4,864
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Detects querying of the NLS/Language registry key, which is often used by Remote Access Trojans (RATs) like VenomRAT and AsyncRAT for system profiling and reconnaissance. The rule specifically looks for processes other than common system processes (svchost.exe, explorer.exe) accessing this registry key.
Detects malicious registry persistence imitating the .NET Runtime Optimization Service by looking for entries in the Run key that start with 'NET Runtime Optimization Service' and point to an executable in 'C:\ProgramData\'. This pattern is often used by adversaries to maintain persistence on a system.
This rule detects the creation of a Run key or login persistence entry by an Electron or Node.js process, where the persistent application is located within the AppData\Local directory. It specifically looks for registry modifications that establish persistence for executables in user-specific application data folders, often indicative of malware or unwanted applications.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Detects reading of AutoLogon credentials stored in Winlogon registry key
Detects addition of AV exclusion paths to hide malicious files from scanning
Identifies the persistence module setting the autostart registry value under the deceptive OneDriveHealthTask moniker.
Detects a user-writable parent process launching at least eight registry queries across four or more browser, credential, software, network, and uninstall areas within ten minutes. This behavior can indicate malicious activity, as adversaries often query the registry to gather system information, discover installed software, or identify persistence mechanisms.
Detects attempts to disable Microsoft Defender's Behavior Monitoring feature by modifying specific registry keys. This activity is often indicative of an adversary trying to evade detection by security software.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Detects bulk registry queries over SMB for system discovery
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
This rule detects attempts to dump LSA secrets by accessing the 'SECURITY\Policy\Secrets' registry key remotely over SMB (port 445). This activity is indicative of credential access attempts, specifically targeting cached credentials or other sensitive information stored in the Local Security Authority (LSA). The rule looks for the specific string 'SECURITY\Policy\Secrets' within TCP traffic destined for port 445, suggesting an attempt to read this registry path.
Detects bulk registry queries over SMB for system discovery
Detects addition of AV exclusion paths to hide malicious files from scanning
Identifies inbound remote RPC calls targeting the Remote Registry interface to save registry keys (OpNums 20 and 31). This is frequently abused for remote credential dumping of SAM/LSA secrets.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
This rule detects attempts to access the NTDS.dit file or the SYSTEM registry hive, indicated by Security Event ID 4656. Multiple access attempts within an hour are summarized by the subject user name.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
Page 35 of 53