Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,456
11,839
5,876
5,155
4,865
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects scenarios where a DLL is loaded by the DNS server in order to escalate privileges or initiate a remote shell.
Detects a Component Object Model (COM) TypeLib hijacking persistence technique. This rule identifies modifications to the registry for the 'Microsoft Web Browser' CLSID, where it is altered to point to a malicious scriptlet (.sct) file. This specific method was used by the MixShell malware in the ZipLine campaign to maintain access.
Detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value. This allows plaintext credentials to be stored in memory, which can then be harvested by attackers. The threat group ShadowSilk has been observed using this technique.
This rule detects the creation or modification of registry keys and values under "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Personal". This activity can indicate unauthorized personal OneDrive usage within an organization, which could be leveraged for data exfiltration, establishing persistence through cloud sync, or user profile manipulation. It is particularly useful for identifying insider threats, compromised servers, or automated exfiltration scripts.
This rule detects commands executed via the Run dialog (Win+R), which is often used by attackers or malicious scripts to launch tools like PowerShell, cmd, or other malicious payloads. It specifically looks for modifications to the 'RunMRU' registry key by 'explorer.exe' that contain suspicious keywords or patterns indicative of command execution, especially in scenarios like ClickFix-style attacks where users are tricked into running commands.
This rule detects the creation or modification of registry values within common Auto-Start Extensibility Point (ASEP) Run keys. It specifically flags entries that point to suspicious file paths (e.g., C:\Users\Public\, C:\ProgramData\, temporary directories) or contain suspicious command-line interpreters (e.g., rundll32, mshta.exe, powershell.exe, wscript.exe, cscript.exe). The rule filters out modifications made by known legitimate processes to reduce false positives.
Enable Rdp Via Registry
YARA-L
Detects a registry modification to enable Remote Desktop Protocol (RDP) by setting the 'fDenyTSConnections' value to 0. This is a common technique used by threat actors, including those deploying KawaLocker, Medusa, and Crypto24 ransomware, to enable lateral movement or establish persistence.
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
Detects instances where NodeJS (node.exe) spawns the Command Processor (cmd.exe) to execute the 'reg add' command. This behavior is a known persistence technique used by the NodeInitRAT backdoor, associated with the Mocha Manakin threat actor, to add a run key to the Windows Registry.
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide a user account from being listed on the logon screen. This is a defense evasion technique used by adversaries to maintain stealth.
Detects the usage of "reg.exe" to tamper with various Windows Defender registry keys. This tampering aims to disable important features related to protection and detection, such as real-time monitoring, cloud protection, tamper protection, and other security functionalities. The rule specifically looks for `reg.exe` commands adding or modifying DWORD values to '0' or '1' for known Windows Defender settings.
Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
This detection identifies the use of two drivers, rwdrv.sys and hlpdrv.sys, which have been observed in Akira ransomware campaigns. The activity includes dropping these drivers, creating associated services, and disabling Windows Defender.
Detects the creation of files and services associated with malicious drivers (hlpdrv.sys, rwdrv.sys) used by Akira ransomware affiliates for defense evasion, as reported by GuidePoint Security. This rule specifically looks for the creation of these driver files and the associated service registrations in the Windows Registry.
This analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. The detection specifically looks for modifications to the 'Run' registry keys or 'ImagePath' values within service registry keys, which are common methods for establishing persistence. The rule leverages a lookup table containing known remote access tools such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
This analytic is developed to detect suspicious registry modifications that disable Remote Desktop Protocol (RDP) by altering the "fDenyTSConnections" key. Changing this key's value to 1 prevents remote connections, which can disrupt remote management and access. Such modifications could indicate an attempt to hinder remote administration or isolate the system from remote intervention, potentially signifying malicious activity.
This rule detects suspicious command-line activity related to enabling Remote Desktop Protocol (RDP) access. Specifically, it looks for `netsh.exe` commands that add a firewall rule to allow inbound TCP traffic on port 3389 (RDP) or enable the 'Windows Management Instrumentation (WMI)' firewall group. It also detects `reg.exe` commands that modify the `fDenyTSConnections` registry value to enable RDP connections.
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
Catches registry modifications that disable security features like Windows Defender, often part of ClickFix attacks where users are told to “fix” security issues by disabling protection.
Detects suspicious commands written to the RunMRU registry key. This is a characteristic of the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and executing it via the Windows Run dialog (Win+R). This technique is notably used by Lumma Stealer affiliates.
Page 68 of 101