Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,443
11,831
5,875
5,151
4,864
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
Detects tampering with EventLog service "file" key. In order to change the default location of an Evtx file. This technique is used to tamper with log collection and alerting
Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes
Hides the file extension through modification of the registry
Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn't be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil".
Detects modification of autostart extensibility point (ASEP) in registry.
Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)
Detect set EnableFirewall to 0 to disable the Windows firewall
Detects .NET Framework CLR and .NET Core CLR "cor_enable_profiling" and "cor_profiler" variables being set and configured.
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun.
The disk cleanup manager is part of the operating system.
It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
The disk cleanup manager is part of the operating system.
It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.
Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
ServiceDll Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry.
This is often used as a method of persistence.
This is often used as a method of persistence.
Detects tampering with the "ChannelAccess" registry key in order to change access to Windows event channel.
Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value.
UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users.
When "UACDisableNotify" is set to 1, UAC prompts are suppressed.
UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system's operation or change settings that affect other users.
When "UACDisableNotify" is set to 1, UAC prompts are suppressed.
Detects changes to the registry values related to outlook security settings
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Page 88 of 101