Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,456
11,839
5,876
5,155
4,865
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
This rule detects potential persistence mechanisms leveraging the Appx DebugPath feature in Windows. Adversaries can modify specific registry keys related to Universal Windows Platform (UWP) applications to inject a malicious DebugPath, which then executes their code when the associated application is launched. The rule specifically looks for modifications to the 'DebugPath' value within 'Classes\ActivatableClasses\Package\Microsoft.' registry paths or the default value within '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.' paths.
Detects the creation or modification of registry run keys to include PowerShell commands or scripts. This technique is commonly used for persistence and privilege escalation, allowing malicious code to execute automatically when a user logs in. The rule specifically looks for common PowerShell keywords and command-line arguments often associated with malicious activity, such as hidden windows, encoded commands, execution policy bypass, and various Invoke- commands for web requests or expression evaluation.
This rule detects attempts to disable Event Tracing for Windows (ETW) logging specifically for the Service Control Manager (SCM) by modifying the 'TracingDisabled' registry key. Adversaries may do this to impair defensive capabilities and hide their activities, as ETW logs are crucial for security monitoring and incident response.
This rule detects the creation or modification of Windows Registry 'Run' keys that point to executable files located in suspicious directories. Adversaries often use 'Run' keys for persistence, ensuring their malicious code executes automatically when a user logs in. By monitoring these keys for entries pointing to common temporary, user-specific, or system-related folders that are not typically used for legitimate application startup, the rule aims to identify potential malicious persistence mechanisms. The rule includes filters for known legitimate activities, such as Windows Update and Spotify, to reduce false positives.
Detects the modification of the Windows Registry to configure a driver or service to persist and load even when the system is booted into Safe Mode (Minimal or Network). This technique can be used by adversaries to maintain access and execute malicious code in a restricted environment, potentially bypassing security controls that are not active in Safe Mode.
Detects modifications to specific autostart extensibility points (ASEPs) within the Wow6432Node Classes registry path. These registry keys are often abused by adversaries to establish persistence or elevate privileges by ensuring their malicious code executes upon system startup or user logon.
Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities.
This rule detects modifications to the 'ObjectName' registry value for the Windows FAX service. Specifically, it triggers when the 'ObjectName' value is changed from anything other than 'NetworkService'. This change could indicate an adversary attempting to escalate privileges or establish persistence by associating the FAX service with a different user account, potentially one with higher privileges or a compromised account, to execute malicious code or maintain access.
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects changes to the NGenAssemblyUsageLog registry key.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
.NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section).
By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created.
Detects modifications to registry keys related to Microsoft Office "Trusted Locations" where an uncommon path is added. Attackers may leverage this to bypass macro security restrictions by adding their malicious document locations as trusted.
This rule detects potential persistence activity by monitoring modifications to the Outlook Today page settings in the Windows Registry. Attackers can leverage this feature by setting a custom URL in the registry keys `Software\Microsoft\Office\<version>\Outlook\Today\URL` or `Software\Microsoft\Office\<version>\Outlook\Today\UserDefinedUrl`, along with setting the `Stamp` value to `0x00000001`. This allows for the execution of arbitrary code when Outlook is opened, providing a persistent foothold on the system.
This rule detects potential persistence via Component Object Model (COM) hijacking by monitoring modifications to the Windows Registry. Specifically, it looks for changes where the 'InprocServer32\(Default)' key is set to 'C:\WINDOWS\system32\scrobj.dll'. Adversaries can abuse scrobj.dll, which looks for the 'ScriptletURL' key to execute scripts, to maintain persistence on a system.
Detects changes to the "ExtErrorInformation" key in the Windows Registry to disable Event Tracing for Windows (ETW) logging specifically for rpcrt4.dll. This modification can be used by adversaries to impair defenses by hiding their activities related to RPC (Remote Procedure Call) communications.
Detects when the 'Notification_Suppress' registry value is set to 1 under 'SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration'. This action disables Windows Security Center notifications, which can be used by adversaries for defense evasion to prevent users from being alerted to security issues.
This analytic detects the addition of new InProcServer32 registry keys on Windows endpoints. Malware often uses this mechanism to achieve persistence or execute malicious code by registering a new InProcServer32 key pointing to a harmful DLL. If confirmed malicious, this could allow an attacker to persist in the environment or execute arbitrary code, posing a significant threat to system integrity and security.
Detects modification of the registry settings used for Internet Explorer and other Windows components that use these settings. An attacker can abuse this registry key to add a domain to the trusted sites Zone or insert JavaScript for persistence
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects VBScript content stored into registry keys as seen being used by UNC2452 group
Page 65 of 101