Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
832 detections
Filters
Last updated
All Time
Detection languages
279
163
136
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,875
5,151
4,864
832
Platforms
831
10
4
2
1
Products / Services
417
219
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects AppInit_DLLs registry modification for persistent DLL injection
Detects disabling of code signing enforcement via registry
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
This rule detects modifications to registry keys (EventID 4657) where the new value contains strings commonly associated with Command and Control (C2) configurations, such as 'C2', 'beacon', 'callback', 'command_server', 'c2_ip', or 'control_server'. This could indicate an adversary establishing or modifying C2 communication channels via the registry.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects registry modifications designed to disable automatic system reboots and scheduled maintenance, preventing the system from interrupting destructive actions, as observed with BLUERABBIT.
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
This rule detects attempts to modify a user's logon script via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS, often used for remote registry) where the content "UserInitMprLogonScript" is present, indicating an attempt to alter this specific registry key. This activity is often associated with persistence techniques used by attackers to maintain access to a system.
Detects replacement of SIP trust provider DLL for code signing bypass
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects the creation or modification of a registry value within the HKCU Run key that points to wscript.exe executing a .js file. This is the primary persistence mechanism for JS.MonoGlyphRAT to maintain a foothold on compromised US enterprise systems.
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects registry modifications to Windows Explorer Advanced settings designed to hide file extensions, hidden files, and protected operating system files. This defense evasion technique is commonly used by malware, such as Gamaredon's GammaWorm, to conceal dropped payloads and replaced LNK files from the user.
This rule detects attempts to modify the remote registry via Server Message Block (SMB) by looking for the strings "winreg" and "RegSetValue" in TCP traffic destined for port 445 on the home network. This activity could indicate an attacker attempting to establish persistence, elevate privileges, or evade defenses by altering system configurations.
Detects the creation or modification of the 'DontOfferThroughWUAU'
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
Page 30 of 40