Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,439
11,829
5,873
5,151
4,864
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects a behavioral chain where a process establishes persistence using a 'WindowsUpdate' Registry Run key or a scheduled task, followed within five minutes by an outbound network connection from the same process. The rule specifically excludes cases where a ZIP file was written to disk, identifying potential in-memory staging for exfiltration.
Detects the modification or creation of the registry key '.mollis' within Software\Classes, which is used by the Star Blizzard (RedFlick) CPL downloader to store an encrypted AES key. This activity is performed by common Windows processes such as control.exe, rundll32.exe, or regsvr32.exe.
Detects the modification or creation of the registry key '.mollis' within Software\Classes, which is used by the Star Blizzard (RedFlick) CPL downloader to store an encrypted AES key. This activity is performed by common Windows processes such as control.exe, rundll32.exe, or regsvr32.exe.
Detects unauthorized modification or creation of registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ to maintain persistence for remote access/RMM tools during Safe Mode with Networking. This technique is used by Akira ransomware affiliates to evade EDR and security software.
Detects modifications to Windows Registry auto-start keys (Run, RunOnce, Winlogon, or Services) by suspicious processes (e.g., script interpreters, shell, or office applications) or processes running from temporary directories, where the registry value points to paths commonly used by adversaries (AppData, Temp, or ProgramData).
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects the modification of the Image File Execution Options (IFEO) registry key for 'smss.exe' to set a Debugger value. This technique is often used for persistence, whereby an adversary redirects the execution of a legitimate system process to a malicious executable (e.g., a renamed binary like svchost.exe located outside of System32).
Detects suspicious commands or script-based execution strings being inserted into the Windows Explorer 'TypedPaths' registry key. This registry key stores the history of paths entered into the Windows Explorer address bar, and attackers can abuse this mechanism to execute arbitrary commands by pasting malicious strings that are then interpreted or executed by the shell.
Detects suspicious command-line fragments being written to the Windows RunMRU registry key, which is used by the Explorer 'Run' dialog to store history. Adversaries may abuse this by injecting malicious command lines that are then executed when a user attempts to run a program.
Once a FileFix chain succeeds, StealC and related loaders commonly establish Run/RunOnce persistence to survive reboot shortly after or before exfiltration.
Detects indicators of RMMCRAT malware installation, which masquerades as JivaChat software. The rule identifies suspicious process execution (e.g., rmm.exe), specific file artifacts created in ProgramData, and persistence mechanisms including Windows service registration, 'Load' registry value abuse, and a unique COM CLSID hijack. The logic enforces corroboration across different signal types (process, file, registry) or triggers on the unique CLSID.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
Detects the MSBuild.exe process adding new root or intermediate certificate authorities to the Windows certificate stores. This activity is indicative of potential malicious PKI infrastructure staging, which can be used to facilitate adversary-in-the-middle (AiTM) attacks or bypass certificate validation.
Detects service-creation commands (sc create / New-Service / reg add under a Services key) whose COMMAND LINE itself references a known NeedyMantis binary name or sideload staging folder. Requiring the malicious reference to appear in the command being executed -- rather than merely in the calling process's own folder location -- removes false matches from unrelated legitimate software that happens to be installed under a similarly-named folder.
Detects service-creation commands (sc create / New-Service / reg add under a Services key) whose COMMAND LINE itself references a known NeedyMantis binary name or sideload staging folder. Requiring the malicious reference to appear in the command being executed -- rather than merely in the calling process's own folder location -- removes false matches from unrelated legitimate software that happens to be installed under a similarly-named folder.
Detects modifications to Windows Registry Run and RunOnce keys by processes other than standard system binaries and known management tools. Such modifications are a common method for achieving persistence by ensuring malicious code executes upon user logon.
Detects suspicious modifications to Windows Registry keys associated with URL protocol handlers or automatic startup mechanisms. Adversaries often use custom URL schemes or registry run keys to maintain persistence or execute malicious code when a specific protocol is invoked or upon user logon.
Page 6 of 101