Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
8
3
2
2
1
Contributors
4
4
3
2
2
Categories
8
7
4
3
1
Platforms
16
1
Products / Services
7
1
1
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
1
IDS Protocols
1
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
Detects the creation or modification of registry values within the AppCertDlls registry key. Adversaries use this technique to achieve persistence by forcing malicious DLLs to be loaded into every process that calls common Windows API functions such as CreateProcess.
Detects the creation or modification of registry values within the AppCertDlls registry key. Adversaries use this technique to achieve persistence by forcing malicious DLLs to be loaded into every process that calls common Windows API functions such as CreateProcess.
Detects AppCertDlls registry key modification for persistent DLL injection
Detects AppInit_DLLs registry modification for persistent DLL injection
This rule detects network traffic attempting to register an AppCert DLL in the Windows Registry for injection purposes. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive string "AppCertDlls". This activity is indicative of a persistence mechanism where a malicious DLL is configured to be loaded into processes, often for privilege escalation or code injection.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
This rule detects the creation or modification of the 'AppCertDlls' registry key. Adversaries can abuse this registry key to achieve persistence and privilege escalation by causing a malicious DLL to be loaded and executed in the context of other processes. The rule specifically looks for changes to the 'HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls' key or its potential rename.
Detects modifications to specific autostart extensibility points (ASEPs) within the Windows Registry's Session Manager key. These modifications can be used by adversaries to establish persistence or elevate privileges by ensuring malicious code is executed during system boot or user logon. The rule specifically targets changes to 'SetupExecute', 'S0InitialCommand', 'KnownDlls', 'Execute', 'BootExecute', and 'AppCertDlls' values under the 'System\CurrentControlSet\Control\Session Manager' path.
Detects modifications to specific registry keys under 'System\CurrentControlSet\Control\Session Manager' that are used for autostart extensibility points (ASEPs). These keys include 'SetupExecute', 'S0InitialCommand', 'KnownDLLs', 'Execute', 'BootExecute', and 'AppCertDLLs'. Adversaries often modify these keys to establish persistence or elevate privileges by ensuring their malicious code runs automatically during system boot or user login.
Detects modification of autostart extensibility point (ASEP) in registry.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry
Detects modification of autostart extensibility point (ASEP) in registry.