Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,456
11,839
5,876
5,155
4,865
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects the modification or creation of the 'Database' registry value under 'Software\Winternals\BGInfo' which can be used by attackers to specify an external database path for BgInfo. This could be leveraged to exfiltrate information collected by BgInfo by directing it to a controlled location.
This rule detects modifications to the Windows Registry keys responsible for DHCP server Callout DLLs. Attackers can leverage this mechanism to install malicious DLLs that execute in the context of the DHCP server, leading to privilege escalation, persistence, and defense evasion. The rule specifically looks for changes to the 'CalloutDlls' and 'CalloutEnabled' values under the 'HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters' path.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
This rule detects modifications to the "DsrmAdminLogonBehavior" registry value. Attackers may modify this value to abuse the Directory Services Restore Mode (DSRM) administrator account for persistence and access to Active Directory. The DSRM account is a local administrator account on a Domain Controller, typically used for restoring AD backups or recovering from failures. By changing "DsrmAdminLogonBehavior" from its default value of '0' (only usable in DSRM) to '1' (usable when AD DS service is stopped) or '2' (always usable), attackers can gain persistent access to the Domain Controller outside of DSRM, facilitating credential access and defense evasion.
Detects registry modifications that hide internal tools or functions from the user, a technique often employed by malware such as Agent Tesla and Hermetic Wiper. The rule specifically looks for changes to registry keys related to hiding clock, health, network, power, and volume icons in the system tray, as well as disabling advanced explorer features like showing info tips or compressed file colors.
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Detects a registry modification that disables security warnings for Microsoft Office macros, specifically setting the 'VBAWarnings' registry value to '1'. This configuration allows the execution of all macros, whether signed or unsigned, which can be abused by attackers for initial access, persistence, or defense evasion.
Detects the setting of the REGISTERAPPRESTART compatibility layer on an application. This compatibility layer allows an application to register for restart using the "RegisterApplicationRestart" API. This can be potentially abused as a persistence mechanism.
Detects potential persistence activity by monitoring the registration of new custom protocol handlers in the Windows Registry. Attackers can abuse this mechanism to establish persistence by setting a custom handler to execute malicious code when a specific URI scheme is accessed. The rule filters out common legitimate Microsoft protocols and applications installed in standard program file locations to reduce false positives.
Detects the creation or modification of a Registry Run key specifically for Windows Explorer, where the value points to suspicious locations such as the Recycle Bin, ProgramData, Temp directories, or Public/Default user profiles. This is a common technique used by adversaries to establish persistence on a system, ensuring their malicious code executes upon user login.
Detects potential persistence behavior by monitoring modifications to the Windows TelemetryController registry key. Adversaries can abuse the `CompatTelRunner.exe` binary, which is used by Windows telemetry, to execute arbitrary commands specified in the registry. This rule specifically looks for modifications to the `TelemetryController` subkey where the `Command` value is set to execute common executable file types.
Detects direct modification of autostart extensibility point (ASEP) in the Windows Registry using the `reg.exe` utility. This rule specifically looks for the 'add' command within `reg.exe` command lines targeting common Run keys and other autostart locations.
Detects the creation or modification of Windows Run keys by executables located in suspicious directories such as user Downloads, temporary Outlook attachments, or Internet Explorer temporary files. This behavior is often indicative of persistence mechanisms used by malware or adversaries.
Detects the modification of a registry value related to BgInfo configuration, specifically within the 'UserFields' subkey, where the 'Details' field starts with '4' (indicating a WMI script). This modification can be abused to execute custom VBScript via 'BgInfo.exe', potentially leading to persistence or defense evasion.
This rule detects attempts to establish persistence by modifying the "DbgManagedDebugger" registry key within the .NET Framework hive. Adversaries can leverage this mechanism to execute a debugger or any specified executable when a .NET application crashes, effectively achieving persistence or privilege escalation. The rule specifically looks for modifications to the 'Debugger' value under the 'Microsoft\.NETFramework\DbgManagedDebugger' key, while filtering out legitimate modifications made by 'vsjitdebugger.exe'.
Detects when the 'UseActionCenterExperience' registry value is set to 0, which disables Windows Security Center notifications. This can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
Detects when the 'DisallowRun' registry value is set to '1' under 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'. This registry setting prevents users from running specified computer programs, which can be used by adversaries for defense evasion or to restrict user capabilities.
This rule detects modifications to the Windows Registry related to Fax Device Providers, specifically looking for changes to the 'ImageName' value within the 'Software\Microsoft\Fax\Device Providers\' path. This technique can be used for persistence by loading a malicious DLL when the Fax service restarts, as highlighted in the provided references.
This rule detects attempts to modify the 'ServiceDll' registry value for the 'wercplsupport' service. This specific modification is associated with the Blue Mockingbird cryptominer, which uses this technique for persistence by hijacking a legitimate service to load its malicious DLL.
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
Detects when the Microsoft Outlook security setting for macro execution is modified to allow macros to run without warning. This change can enable malicious macros to execute automatically, potentially leading to persistence, privilege escalation, or further compromise.
Page 64 of 101