Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61 detections
Filters
Last updated
All Time
Detection languages
32
18
6
2
1
Contributors
22
7
6
5
5
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
60
1
1
Products / Services
17
10
10
3
3
MITRE Techniques
39
23
14
13
11
IDS Classtypes
1
IDS Protocols
1
Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"
Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.
Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
Detects the deletion of registry keys containing the MSTSC connection history
This rule detects attempts to hijack file associations by monitoring command-line executions of 'cmd.exe' or 'reg.exe' that involve deleting 'UserChoice' registry keys or adding 'ApplicationAssociationToasts'. This behavior is indicative of an adversary attempting to modify default program associations to achieve persistence or execute malicious code.
Detects the creation of a 'WSPrint' scheduled task followed by deletion of its Security Descriptor (SD) registry value. Deleting the SD value hides the task from schtasks /query and Task Scheduler. This technique is used by UAT-9244 for stealthy persistence and is also associated with HAFNIUM/Tarrask.
Detects the deletion of the RunMRU registry key and the clearing of the clipboard within a short time window on the same host. This sequence of anti-forensic actions is used by the batch script component of the Dohdoor malware campaign to hide its tracks.
The rule detects the deletion of specific registry keys associated with UAC bypass techniques. Specifically, it looks for deletions where the 'TargetObject' field contains the string '\ms-settings\Shell\Open\command'. This activity is indicative of anti-forensics, as an attacker might delete these keys to remove evidence of privilege escalation after performing a UAC bypass.
Detects deletion of ms-settings registry keys used for UAC bypass techniques, indicating anti-forensics activity to remove evidence of privilege escalation.
Detects the deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. Adversaries may delete this key to cover their tracks after executing commands, particularly in techniques like those used in clickfix where phishing lures instruct users to execute malicious commands via the Run dialog.
Detects the deletion of registry entries within the `.*\shell\open\command` keys. This activity is often associated with COM hijacking, where an attacker modifies these keys to execute their malicious code instead of legitimate applications. The deletion of these keys could indicate an adversary attempting to remove traces of their COM hijacking activities.
Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. Adversaries may delete this key to cover their tracks after executing commands, especially in scenarios like clickfix techniques where users are lured into executing malicious commands via the run dialog.
This rule detects attempts to clear the connection history for Microsoft Terminal Server Client (MSTSC) by deleting specific registry keys or values. This activity can be performed by an attacker to remove forensic evidence of their remote access to a system.
Detects the deletion of a registry key responsible for the 'Scan with Defender' option in the Windows context menu. Attackers may delete this key to hinder users from easily scanning suspicious files, thereby weakening defenses.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection, which is a defense evasion technique.
The analytic identifies the deletion or modification of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.
This detection identifies the deletion of registry keys under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\, which store records of previously connected remote systems via Remote Desktop Protocol (RDP). These keys are created automatically when a user connects to a remote host using the native Windows RDP client (mstsc.exe) and can be valuable forensic artifacts for tracking remote access activity. Malicious actors aware of this behavior may delete these keys after using RDP to hide evidence of their activity and avoid detection during incident response. This form of artifact cleanup is a known defense evasion technique, often performed during or after lateral movement. Legitimate users rarely delete these keys manually, making such actions highly suspicious—especially when correlated with RDP usage, unusual logon behavior, or other signs of compromise. Detecting the deletion of these registry entries can provide crucial insight into attempts to cover tracks following interactive remote access.
Detects the use of `reg.exe` or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
Page 2 of 3