Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
160 detections
Filters
Last updated
All Time
Detection languages
68
58
9
8
6
Contributors
35
31
21
19
13
Categories
77
47
32
25
23
Platforms
156
1
1
1
Products / Services
58
43
17
9
4
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
7
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects potential COM hijacking of the CLSID InprocServer32 registry keys or unauthorized loading/creation of the 'EhStoreShell.dll' file. These behaviors are common indicators of persistence mechanisms or DLL side-loading where attackers redirect legitimate system calls to malicious code.
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
This rule detects potential COM hijacking of the CLSID InprocServer32 registry keys or unauthorized loading/creation of the 'EhStoreShell.dll' file. These behaviors are common indicators of persistence mechanisms or DLL side-loading where attackers redirect legitimate system calls to malicious code.
This rule monitors for potential persistence and malicious activity by aggregating three distinct detection signals: COM hijacking attempts via the InprocServer32 registry key, the creation of scheduled tasks using specific suspicious naming conventions, and the identification of named mutexes indicative of specific malware presence.
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Detects modifications or creation of InprocServer32 COM registry keys by suspicious processes like mshta.exe or powershell.exe, which is indicative of COM Hijacking for persistence or privilege escalation.
Detects modifications or creation of InprocServer32 COM registry keys by suspicious processes like mshta.exe or powershell.exe, which is indicative of COM Hijacking for persistence or privilege escalation.
Detects modifications or creation of InprocServer32 COM registry keys by suspicious processes like mshta.exe or powershell.exe, which is indicative of COM Hijacking for persistence or privilege escalation.
Detects modifications or creation of InprocServer32 COM registry keys by suspicious processes like mshta.exe or powershell.exe, which is indicative of COM Hijacking for persistence or privilege escalation.
Detects TWINLOOT persistence mechanisms observed in the TWINLOOT Python implant framework, including COM hijacking via a scriptlet (.sct) reference written to the TypeLib registry key for CLSID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} version 1.1 (win32/win64), and the creation of a Run key value named 'UserExperienceSync' under CurrentVersion\Run for autorun persistence.
Detects the COM hijacking persistence used by the MuddyWater-linked PatchAgent loader chain: cloud.dll registers itself under the campaign-specific CLSID {7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32 via DllRegisterServer, so any later COM instantiation of that CLSID re-loads and re-executes the Stage 1 dropper. The CLSID is a hard, campaign-unique indicator.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.
Detects potential UAC bypass or COM hijacking activities by monitoring for anomalous process spawning patterns from Windows auto-elevating binaries (e.g., eventvwr.exe, fodhelper.exe, sdclt.exe) or suspicious child processes spawned by DllHost.exe from user-writable directories.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects various methods of bypassing Windows User Account Control (UAC), including auto-elevating binaries spawning suspicious child processes, registry key hijacks (e.g., in HKEY_CURRENT_USER\Software\Classes) used to execute elevated code without prompts, and attempts to disable UAC via the 'EnableLUA' registry value.
Page 3 of 8