Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,456
11,839
5,876
5,155
4,865
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
This rule detects modifications to the 'NoLMHash' registry value, specifically when it is set to '0' (DWORD). Setting this value to '0' allows Windows to store LAN Manager (LM) hashes of user passwords in Active Directory and local Security Account Manager (SAM) databases. This action significantly weakens security as LM hashes are highly vulnerable to cracking, making credential theft easier for attackers. Attackers often enable LM hash storage to facilitate 'Pass the Hash' attacks or offline password cracking.
This rule detects modifications to the Winlogon Notify registry key to establish persistence. Adversaries may abuse Winlogon's features to execute DLLs when a user logs in. The rule specifically looks for changes to the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon` registry key where the `Details` field indicates a DLL file (`.dll`) is being set.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for .NET processes by modifying registry values. Adversaries might do this to impair defensive capabilities and hide their activities, particularly when using .NET-based malware or tools.
Detects changes to the "NoLMHash" registry value to allow Windows to store LM Hashes. Setting this registry value to "0" (DWORD) enables the storage of LAN manager hashes of passwords in Active Directory and local SAM databases, which can facilitate 'Pass the Hash' attacks.
Detects the creation or modification of Windows services in the registry that exhibit patterns commonly associated with Cobalt Strike beacons for persistence, privilege escalation, or lateral movement. Specifically, it looks for registry modifications to service control sets containing 'ADMIN$' and '.exe' or '%COMSPEC%', 'start', and 'powershell' in the service details, indicating a potential malicious service installation.
Detects the disabling of crash dumps by modifying the 'CrashControl' registry key to set the 'CrashDumpEnabled' value to 0. This activity has been observed in malware like HermeticWiper to hinder forensic analysis.
Detects VBScript content stored into registry keys, specifically targeting the 'Software\Microsoft\Windows\CurrentVersion' path, which is often used for persistence. The rule looks for keywords indicative of VBScript or JScript execution, such as 'vbscript:', 'jscript:', 'mshtml,', 'RunHTMLApplication', 'Execute(', 'CreateObject', and 'window.close'. It explicitly filters out legitimate MSIEXEC activity related to .NET installations in specific registry paths to reduce false positives. This activity has been observed in campaigns by groups like UNC2452.
This rule detects attempts to manipulate Control Panel Items, which can be used by adversaries for privilege escalation, execution, or defense evasion. It specifically looks for two main scenarios: 1) The use of 'reg.exe' to add entries to the 'CurrentVersion\Control Panel\CPLs' registry key, which is a known method for registering malicious Control Panel items. 2) The execution of '.cpl' files outside of standard system directories, indicating potentially malicious or unusual Control Panel item activity. The rule filters out common legitimate system CPL executions to reduce false positives.
This rule detects modifications to the Windows Registry keys associated with Application Shimming. Adversaries may use application shims to establish persistence and/or elevate privileges by executing malicious content. The rule specifically looks for changes within the 'InstalledSDB' and 'Custom' AppCompatFlags registry paths, which are used to store information about installed shim databases.
This rule detects modifications to the Windows Registry key `HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential` where its value is set to `0x00000001`. This modification enables the WDigest protocol to store clear-text credentials in memory, making them vulnerable to credential dumping attacks. Adversaries often enable this setting to facilitate the extraction of user credentials from the Local Security Authority Subsystem Service (LSASS) process.
Detects changes to the default RDP port (3389) in the Windows Registry. Adversaries may modify the RDP port to maintain persistence or evade detection, as this change can allow them to continue using RDP for remote access on a non-standard port.
Detects registry changes to Office trust records where the path is located in a potentially suspicious location, indicating that a macro-enabled document from an unusual or untrusted location has been allowed to run. This could be indicative of an attempt to bypass security controls by executing malicious macros from temporary folders, internet caches, or public user directories.
Detects registry modifications that disable internal tools or functions in explorer, a technique often used by malware like Agent Tesla to hinder user interaction or hide malicious activities.
Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).
This rule detects the creation or modification of a Windows service where the service binary's path is located in a suspicious directory. Adversaries often place malicious service executables in non-standard or temporary locations to evade detection and establish persistence. The rule specifically looks for service image paths containing '\Users\Public\', '\Perflogs\', '\ADMIN$\' or '\Temp\'.
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Detects potential COM object hijacking by monitoring modifications to the default values of InprocServer32 or LocalServer32 subkeys within specific CLSIDs in the Windows Registry. The rule specifically looks for these modifications occurring in suspicious file system locations commonly used by adversaries for persistence or staging.
Detects modifications to Internet Explorer's autostart extensibility points (ASEPs) in the Windows Registry. Adversaries may modify these registry keys to establish persistence or elevate privileges by ensuring malicious code executes when Internet Explorer starts or when a user logs in.
Detects when the 'fAllowToGetHelp' registry value is set to 1, which enables the Remote Assistance feature on a Windows machine. This allows a specific user to establish an RDP connection for remote assistance.
Detects modifications to autostart extensibility points (ASEP) within the Windows Registry, specifically focusing on keys under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' that are commonly used for persistence. This includes modifications to Winlogon, Windows, Image File Execution Options, Font Drivers, and Drivers32 subkeys. The rule includes filters for known legitimate activities by Microsoft Edge, Microsoft Office, OneDrive, Avira, and .NET Framework's NGEN.
Detects the modification of a registry value under `\Software\Winternals\BGInfo\UserFields\` where the `Details` field starts with '6', indicating a custom WMI query. This activity can be abused by adversaries to execute arbitrary WMI queries via BgInfo.exe, potentially leading to persistence or defense evasion.
Page 63 of 101