Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
832 detections
Filters
Last updated
All Time
Detection languages
279
163
136
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,875
5,151
4,864
832
Platforms
831
10
4
2
1
Products / Services
417
219
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects persistence established by modifying the Windows Registry 'Run' key, specifically targeting the 'EdgeUpdate' value to launch a Node.js binary. This technique allows an attacker to execute arbitrary code each time a user logs in.
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects suspicious modifications to Chrome browser extensions by monitoring registry events. Specifically, it looks for changes within the 'Chrome\Extensions' registry key where the 'chrome_settings_overrides' value name is set and its data contains the string 'search'. This pattern is indicative of an extension attempting to hijack browser search settings, often a tactic used by unwanted programs or malware to redirect user searches to malicious or ad-filled sites.
This rule detects attempts by PowerShell to modify the Windows Registry to re-enable Windows Script Host. This behavior has been observed with AsyncRAT, which may attempt to repair the script environment if it was disabled by defenders.
Detects registry run key persistence using a specific pattern 'Install Microsoft Teams v0.*' in the RegistryValueName, indicating potential backdoor activity.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
This rule detects suspicious modifications to Chrome browser extensions by monitoring registry events. Specifically, it looks for changes within the 'Chrome\Extensions' registry key where the 'chrome_settings_overrides' value name is set and its data contains the string 'search'. This pattern is indicative of an extension attempting to hijack browser search settings, often a tactic used by unwanted programs or malware to redirect user searches to malicious or ad-filled sites.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects attempts to disable Defender Real-Time Monitoring by modifying a specific registry key and value. This action indicates an adversary trying to impair defensive capabilities.
Detects the creation or modification of registry run keys that establish persistence for the Prinz Eugen ransomware. The rule specifically looks for registry entries under 'Software\Microsoft\Windows\CurrentVersion\Run' that contain common environment variables (e.g., %APPDATA%, %TEMP%) and specific filenames or paths associated with Prinz Eugen ransomware (e.g., 'servertool', 'encrypt.exe', '\Music\', '\Desktop\').
Detects modifications to the 'Run' registry key for persistence, specifically looking for indicators associated with Prinz Eugen ransomware such as 'servertool', 'encrypt.exe', 'lock.exe', or 'ransom' in the registry value data. It excludes common legitimate paths to reduce false positives.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
Detects replacement of service binaries for execution flow hijacking
Detects modification of file associations to hijack execution flow
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
This rule detects attempts to modify registry keys related to proxy settings, specifically 'ProxyOverride', 'ProxyServer', or 'NoProxy', to include local bypass addresses such as 'localhost', '127.0.0.1', or '<local>'. This activity could indicate an adversary attempting to bypass network proxies for command and control or data exfiltration.
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects attempts to modify registry keys related to proxy settings, specifically 'ProxyOverride', 'ProxyServer', or 'NoProxy', to include local bypass addresses such as 'localhost', '127.0.0.1', or '<local>'. This activity could indicate an adversary attempting to bypass network proxies for command and control or data exfiltration.
Page 29 of 40