Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
832 detections
Filters
Last updated
All Time
Detection languages
279
163
136
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,875
5,151
4,864
832
Platforms
831
10
4
2
1
Products / Services
417
219
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects modifications to Windows registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or suppressing UAC prompts, when performed by scripting engines like wscript.exe or cscript.exe. This activity is often associated with malware or adversarial post-exploitation efforts to impair defensive capabilities and maintain persistence.
Detects unauthorized modifications to the Image File Execution Options (IFEO) registry keys for 'cmd.exe'. The rule specifically looks for the 'Debugger' value being set to script-based interpreters (e.g., .vbs, .js, wscript, cscript), a technique known to be used by LCRYX ransomware to intercept security tool execution and establish persistence.
This rule detects unauthorized modifications to common Windows persistence registry keys, including 'Run' keys, the 'Winlogon Shell' value, and 'Image File Execution Options' (IFEO) debugger values. These modifications are commonly used by adversaries to establish persistence or intercept process execution.
GraphWorm Persists through a Run Key
Cortex XDR
Detects the creation or modification of a Windows Registry Run key that points to an executable with names associated with GraphWorm or C2OverOneDrive malware, or an unusual OneDrive-themed binary located outside of legitimate OneDrive client paths. This rule specifically looks for registry events where the key name contains 'CurrentVersion\Run' and the data contains 'C2OverOneDrive', 'GraphWorm', 'OneDrive.*AppData', or 'config.dat'.
Detects registry modifications enabling Developer Mode, a strict prerequisite for UnCanny loose-file UNC registration. This modification involves setting the 'AllowDevelopmentWithoutDevLicense' registry value to '1' under the 'AppModelUnlock' key.
Detects persistence established via the Windows Run registry key, specifically looking for an entry named 'WindowsHost' that launches a Node.js binary (node.exe). This technique is often used by adversaries to maintain access to a system after reboot or user login.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects modifications to the Windows QoS Group Policy registry hive, which can be used as a persistence mechanism for EDR throttling or other malicious purposes. This rule specifically looks for any registry events within the 'SOFTWARE\Policies\Microsoft\Windows\QoS' path.
Detects the creation or modification of a Windows Registry run key ('browser') that points to an executable located in the AppData\Local directory. This behavior is indicative of an adversary establishing persistence by masquerading a malicious process as a browser.
Detects modifications to the 'Debugger' registry value for the 'agntsvc.exe' executable under 'Image File Execution Options'. This technique, known as IFEO injection, is used by adversaries to gain persistence or privilege escalation by forcing a malicious binary to run whenever a specific process is launched.
This rule detects two indicators associated with ransomware activity: the modification of the 'legalnoticetext' registry value, which is often used to display ransom notes on the Windows login screen, and the execution of Notepad to open a file named 'HowToRestoreFiles.txt', a common indicator of a ransom note left by ransomware operators.
Detects the creation or modification of Windows Registry Run keys that point to Node.js related files or JavaScript/module scripts, specifically excluding those signed by Microsoft or the OpenJS Foundation. This is a common technique used by attackers to maintain persistence by executing scripts automatically upon user logon.
Detects modifications to COM InprocServer32 registry keys under HKEY_CURRENT_USER. This activity is often associated with COM hijacking, a technique used by adversaries to achieve persistence or execute malicious code when a hijacked COM object is invoked by legitimate applications. The rule specifically flags suspicious or non-Microsoft COM registrations, particularly those pointing to files within the user's AppData/Local directory.
Detects the TuglaInsaatci steganographic loader establishing persistence via a Windows Run registry key. The rule identifies suspicious PowerShell commands (execution policy bypass, hidden window, hidden file path) pointing to a script located within the AppData\Local\Temp directory, a technique associated with the FortiBleed campaign to deliver the Remcos RAT.
Detects modifications to the registry re-enabling Windows Script Host to execute VBS payloads, often associated with malware like AsyncRAT.
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
This rule detects the creation or modification of a registry run key named "Edgre" where the associated value data points to the `C:\Users\Public\` directory. This behavior is associated with the Operation XENOFISCAL campaign, specifically for establishing persistence by placing malicious payloads in a publicly accessible user directory.
Identifies Kazuar modifying the HKCU\Environment registry key to load its malicious DLL via the user initialization routine (UserInitMprLogonScript).
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects the creation or modification of registry run keys that establish persistence for the Prinz Eugen ransomware. The rule specifically looks for registry entries under 'Software\Microsoft\Windows\CurrentVersion\Run' that contain common environment variables (e.g., %APPDATA%, %TEMP%) and specific filenames or paths associated with Prinz Eugen ransomware (e.g., 'servertool', 'encrypt.exe', '\Music\', '\Desktop\').
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
Page 28 of 40