Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,456
11,839
5,876
5,155
4,865
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
This query identifies an anomalous pattern associated with behavior performed by NotDoor to establish persistence and avoid its detection.
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Detects attempts to disable Windows Defender's real-time monitoring feature by modifying its corresponding registry key. This technique is commonly used by malware, such as FormBook RAT, to evade detection.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects persistence and execution artifacts associated with the Latrodectus malware. This includes the creation of a misspelled registry run key ('sentinelssheduler') and the execution of a payload masquerading as SentinelOne from a non-standard AppData path.
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links.
ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages.
Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content,
such as one-liners that execute remotely hosted malicious files or scripts.
ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages.
Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content,
such as one-liners that execute remotely hosted malicious files or scripts.
Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.
Detects COM object hijacking via TreatAs subkey
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Below is a list of registry keys/values that are monitored by this rule:
- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Below is a list of registry keys/values that are monitored by this rule:
- Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user's session.
- DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions.
- DisableSecuritySettings: Disables certain security settings for Remote Desktop connections.
- fAllowUnsolicited: Allows unsolicited remote assistance offers.
- fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control.
- InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer.
- ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service.
- SecurityLayer: Specifies the security layer used for RDP connections.
Detects creation of "UserInitMprLogonScript" registry value which can be used as a persistence method by malicious actors
Detects modification of autostart extensibility point (ASEP) in registry.
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Hides the file extension through modification of the registry
Detects modification of autostart extensibility point (ASEP) in registry.
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
Detects changes to the default RDP port.
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Detects when an attacker adds a new AMSI provider via the Windows Registry to bypass AMSI (Antimalware Scan Interface) protections.
Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content.
This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.
Attackers may add custom AMSI providers to persist on the system and evade detection by security software that relies on AMSI for scanning scripts and other content.
This technique is often used in conjunction with fileless malware and script-based attacks to maintain persistence while avoiding detection.
Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key
Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.
Detects the creation of the "EdgeUpdateCore" Run key, a persistence mechanism used by the LeakyStealer malware.
Page 60 of 101