Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,456
11,839
5,876
5,155
4,865
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
This rule detects the creation of a registry run key (Run or RunOnce) that attempts to establish persistence by executing a DLL via regsvr32. It specifically looks for registry value data containing 'regsvr32' followed by a DLL path. The rule then correlates this registry event with a file creation event for the same DLL on the same device within a specified timeframe, indicating a potential persistence mechanism where a malicious DLL is dropped and then configured to run at startup.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys. Specifically, it looks for HTTP/HTTPS links combined with suspicious keywords related to CAPTCHA/verification or common command-line utilities, which are indicative of clipboard hijacking and execution of remotely hosted malicious files or scripts.
Detect the creation of a service with a service binary located in a suspicious directory
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the `RunMRU` registry key. This technique is often abused by threat actors to trick users into pasting and executing malicious commands, sometimes disguised as CAPTCHA verification steps. The rule filters out common legitimate entries to reduce false positives.
The analytic detects modifications to the Windows registry entry "DisableRestrictedAdmin," specifically when its value is set to 0x00000000. This action disables the Restricted Admin mode, a security feature that limits credential exposure during remote connections. Monitoring this activity is crucial as changes to this setting can weaken security controls, increasing the risk of credential theft and unauthorized access to sensitive systems. This detection leverages registry activity logs from endpoint data sources like Sysmon.
This rule detects XWorm persistence mechanisms. It looks for the creation of scheduled tasks, registry run keys, or startup folder shortcuts that execute suspicious payloads from the AppData\Roaming directory. The malware is known to use filenames like "WmiPrvSE.exe" (masquerading as a legitimate system file) and "Soundman.exe").
Detects persistence mechanisms associated with a Winos malware variant. This includes the creation of the 'Software\DeepSer' registry key or the modification of the 'User Shell Folders\Startup' key to redirect to a malicious folder.
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
The analytic detects the modification of the Windows Registry key "LoadMacroProviderOnBoot" under Outlook. This enables automatic loading of macros, which could allow malicious scripts to run without notice. This detection leverages data from the Endpoint.Registry datamodel to search for this key being enabled. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
KQL Query
Detects various activities associated with the AppSuite PDF Editor backdoor, a trojanized application with extensive backdoor capabilities. This rule looks for specific command-line execution, persistence mechanisms, and network communications.
Detects scenarios where an attacker modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.
Detects modifications to the default program associated with .txt files, specifically looking for changes to the 'open' command or 'UserChoice' registry keys. This can be indicative of an adversary attempting to establish persistence or execute malicious code when a user opens a text file.
Detects attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This technique is used by malware like Salat Stealer to bypass security prompts and perform administrative tasks without user approval.
Detects registry modifications associated with the NotDoor backdoor used by APT28. The malware modifies Outlook registry keys to enable macros on boot, lower security settings, and disable dialog messages to achieve persistence and evade user detection.
Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.
Detects scenarios where an attacker attempts to enable Wdgiest authention so passwords are stored in clear text and can be dumped.
This detection identifies attempts to disable Microsoft Defender Antivirus or bypass its protection mechanisms such as Tamper Protection or Real-Time Protection.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Page 67 of 101