Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
832 detections
Filters
Last updated
All Time
Detection languages
279
163
136
91
73
Contributors
237
142
128
86
62
Categories
20,443
11,831
5,875
5,151
4,864
832
Platforms
831
10
4
2
1
Products / Services
417
219
158
98
58
MITRE Techniques
571
339
262
243
175
CVEs
3
2
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
Detects regedit.exe being used to import a registry (.reg) file located in the C:\ProgramData\ directory. This technique is utilized in the Nimbus RAT attack chain, where users are socially engineered via Teams to manually import a pre-staged .reg file (e.g., InboxCorePro.reg) to establish persistence on the host.
Detects the creation or modification of a registry value within the Run key that points to wscript.exe executing a .js file, which is a primary persistence mechanism for JS.MonoGlyphRAT. The rule specifically looks for modifications to user-level Run keys and checks for 'wscript.exe' and '.js' within the RegistryValueData, accounting for potential additional arguments after the .js file path.
Detects registry modifications setting ConsentPromptBehaviorAdmin to 0, which weakens UAC protections by elevating without prompting. This behavior was observed in the TAX#TRIDENT campaign where a script disguised as a PNG altered UAC policies prior to silently installing a ManageEngine agent.
Detects unauthorized or unexpected modifications setting DisableLockWorkstation to 1 in the HKCU Policies path. This modification is explicitly used in the GreenPlasma exploit chain to retain interactive workstation access once SYSTEM execution is achieved.
Detects suspicious command line interpreters or downloaders stored in the Windows RunMRU registry key. This technique is often used in ClickFix attacks where users are socially engineered into pasting malicious commands into the Windows Run dialog.
Detects modifications to the msDS-KeyCredentialLink attribute on Delegated Managed Service Account (dMSA) objects, indicating a potential Shadow Credential (X.509 certificate) planting. This allows an attacker to bypass managed password rotation and maintain permanent PKINIT access, as seen in the dMSA Ouroboros attack chain. The rule also monitors Event 4768 (PKINIT TGT requests with pre-authentication type 17) and Event 4662 (S4U2Self Object Access) for dMSA objects, which are key indicators of this attack.
Monitors for modifications to the LocalAccountTokenFilterPolicy registry key being set to 1, a technique used by the IOX proxy (and SHADOW-EARTH-053) to enable Pass-the-Hash attacks and grant administrative rights to remote connections.
Detects command line execution attempting to modify fDenyTSConnections registry value via reg add — used by attackers to enable RDP for lateral movement
Detects registry modification to fDenyTSConnections — used to enable or disable Remote Desktop access. Attackers modify this value to enable RDP for lateral movement or persistent remote access
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Potential threat actor tampering with Sysmon manifest and eventually disabling it
Detects NetNTLM downgrade attack
Detects registry modifications to the SpecialAccounts\UserList key, setting a value to 0 to hide an account from the Windows login screen. This technique is observed in the CTRL framework to conceal backdoor accounts (e.g., Administrator, Admin, Windows).
This rule detects the execution of common accessibility tools (osk.exe, powershell.exe, pwsh.exe, cmd.exe, reg.exe) with command-line arguments indicating an attempt to modify or leverage Windows accessibility features for persistence or privilege escalation. Specifically, it looks for command lines referencing 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility' and 'ATConfig\osk' or 'Accessibility\Session'. This behavior is often associated with adversaries attempting to maintain access or elevate privileges by manipulating accessibility programs like the On-Screen Keyboard.
Detects potential COM hijacking used by Sednit (APT28) malware like BeardShell and SlimAgent for persistence. This involves modifying InprocServer32 registry keys to point to malicious DLLs.
Page 31 of 40