Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,875
5,151
4,864
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects the modification of the Print Spooler (Spooler) Windows service configuration via command-line registry utilities (reg.exe or regedit.exe). This activity may indicate an attempt to restore or re-enable the Print Spooler service, which is frequently targeted for disabling as a mitigation strategy against vulnerabilities like PrintNightmare.
This rule detects potential malicious activity where a process attempts to communicate over DNS over HTTPS (DoH) using common public resolvers (e.g., Google DNS) while simultaneously establishing persistence via Windows Registry 'Run' keys. It excludes common, legitimate applications known to use DoH, focusing on unexpected processes. The detection relies on correlating network events (DoH to known public resolvers) with registry modification events occurring within a 30-minute window of the network activity.
Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value.
The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts.
When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.
The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts.
When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.
Detects modifications to the 'metrics_interval' registry value within the 'Software\SynapseAgent' key. This activity suggests configuration changes to the SynapseAgent, which could indicate tampering with agent telemetry or polling frequency.
Detects the modification or creation of the 'SealedConfig' value within the 'Software\synapse\Config' registry key, correlated with the deletion of a 'config.toml' file on the same device. This pattern may indicate an adversary tampering with Synapse software configuration or attempting to remove audit/configuration trails.
Detects the addition of suspicious file names or known potentially unwanted program artifacts to Windows Run registry keys, often used for persistence. The rule correlates registry modifications with potential installer process activity.
Detects modifications to Windows Defender registry keys responsible for exclusions. Specifically monitors when paths or processes associated with potentially suspicious locations (like C:\Drivers) or common system binaries (VSSVC.exe, ctfmon.exe, C:\Windows\System32) are added to the Defender exclusion list. This is a common technique used by attackers to hide malicious files or activity from antivirus scanning.
Detects the use of reg.exe to modify a Windows Run registry key to execute a destructive 'format C:' command upon system startup, indicative of wiper-style malware activity.
Detects the use of reg.exe to create persistence via Windows Registry Run or RunOnce keys using specific naming conventions commonly associated with Stealer/1.0 malware (e.g., SystemUpdate, SystemCheck) targeting files located in the Downloads directory.
Detects persistence and configuration activity associated with the CornFlake RAT, including the creation of malicious Windows services (e.g., 'svchost32', 'Cloud Sync Service'), registry run key modifications, and the presence of specific file artifacts like 'sync.dat' and malicious executables within AppData directories.
Detects the modification of a Windows Registry Run key using reg.exe to schedule a forced system shutdown. This pattern is often associated with wipers or disruptive malware attempting to ensure system unavailability upon reboot or login.
Detects the creation of Windows Registry Run keys that masquerade as legitimate Realtek or WinAudio services. These keys point to executables located in user-writable paths such as AppData, Roaming, or Temp, a technique commonly associated with persistence mechanisms for malware like the Chaos ransomware.
Detects the addition of suspicious file names or known potentially unwanted program artifacts to Windows Run registry keys, often used for persistence. The rule correlates registry modifications with potential installer process activity.
Detects the creation of an NTUSER.MAN file followed by an update or creation of a registry run key (Run or RunOnce) on the same device within a 60-minute window. NTUSER.MAN is a mandatory user profile file that, when present, can be used to override user settings and persist malicious configurations or startup entries.
Detects the creation or modification of registry keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. These keys are commonly used by adversaries to achieve persistence by ensuring arbitrary programs or scripts execute automatically when the current user logs in.
ServiceDll Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry.
This is often used as a method of persistence.
This is often used as a method of persistence.
Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.
There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.
Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.
Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
Detects additions or modifications to the Registry 'Run' keys in HKEY_CURRENT_USER, which are a common technique used by malware and adversaries to achieve persistence by automatically executing programs upon user logon.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
This rule detects installation, file activity, or registry configuration changes associated with the 'bright-save-feed@tabtools.org' browser extension identifier. Such identifiers are commonly associated with malicious browser add-ons or potentially unwanted programs (PUPs) that may be used for browser session hijacking, unauthorized content injection, or persistent access.
Page 21 of 101