Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
160 detections
Filters
Last updated
All Time
Detection languages
68
58
9
8
6
Contributors
35
31
21
19
13
Categories
77
47
32
25
23
Platforms
156
1
1
1
Products / Services
58
43
17
9
4
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
7
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects modifications to COM object InProcServer32 registry keys within the user's registry hive (HKEY_USERS). Attackers often hijack COM objects to achieve persistence by pointing them to malicious DLLs or OCX files. This rule specifically filters out common legitimate paths (Windows directories, Program Files) and known installers to reduce noise.
Detects modifications to COM object registration keys under HKEY_CURRENT_USER (HKCU) which can be used to hijack COM objects for persistence. The rule monitors for the creation or modification of InProcServer32 or LocalServer32 values, while excluding common system paths to reduce noise.
Detects persistence via registry modification commonly associated with RomCom adversary activity (e.g., Mythic, SnipBot, MeltingClaw) post-CVE-2025-8088 exploitation.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
Detects modifications to the 'Software\Classes\ms-settings\shell\open\command' registry key, a technique commonly used to bypass User Account Control (UAC). By setting the default handler for the ms-settings protocol to a malicious command, an attacker can achieve elevated execution when the protocol is triggered by a legitimate Windows component.
This rule detects the creation or modification of a COM object registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\ with an 'InProcServer32' subkey. This is a common technique used by adversaries for persistence and privilege escalation by hijacking COM object references to execute arbitrary malicious code when the legitimate application attempts to use the hijacked COM object.
This rule detects the creation or modification of a COM object registry key under HKEY_CURRENT_USER\Software\Classes\CLSID\ with an 'InProcServer32' subkey. This is a common technique used by adversaries for persistence and privilege escalation by hijacking COM object references to execute arbitrary malicious code when the legitimate application attempts to use the hijacked COM object.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects modifications to Windows Registry keys commonly associated with COM hijacking. Attackers modify these keys to redirect legitimate system calls to malicious executables, achieving persistence and potential privilege escalation. This rule monitors for registry value creation or modification in keys related to shell open commands for MS-settings, MSC files, or executables.
Detects modifications to COM object InProcServer32 registry keys within the user's registry hive (HKEY_USERS). Attackers often hijack COM objects to achieve persistence by pointing them to malicious DLLs or OCX files. This rule specifically filters out common legitimate paths (Windows directories, Program Files) and known installers to reduce noise.
Detects the modification or creation of registry keys related to COM InprocServer32 within the HKEY_CURRENT_USER hive, specifically pointing to executable or library files residing within the user's AppData/Local directory. This technique is commonly used by adversaries for persistence by hijacking COM objects to execute malicious code when legitimate software invokes the hijacked component.
Detects modifications to Windows Registry keys related to Component Object Model (COM) objects (CLSID or InprocServer32) where the registry value points to suspicious file paths, specifically those within temporary directories like Temp or AppData. This behavior is indicative of an attacker attempting to establish persistence or perform privilege escalation by hijacking COM object execution flow.
Detects modifications to Windows Registry keys related to Component Object Model (COM) objects (CLSID or InprocServer32) where the registry value points to suspicious file paths, specifically those within temporary directories like Temp or AppData. This behavior is indicative of an attacker attempting to establish persistence or perform privilege escalation by hijacking COM object execution flow.
This rule detects modifications to Windows Registry keys related to COM object handlers (InprocServer32/LocalServer32) within User registry hives. It specifically identifies when a COM object is registered to point to a file path residing in suspicious, user-writable directories (e.g., Temp, AppData, Downloads) or arbitrary user directories, which is a common indicator of COM hijacking for persistence or privilege escalation.
Detects COM hijacking of the UnexpectedShutdownReason CLSID used by the PRISMEX dropper to establish persistence. This rule specifically looks for modifications to the InProcServer32 subkey for the CLSID {68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}.
Detects modifications to Windows Registry keys commonly associated with COM hijacking. Attackers modify these keys to redirect legitimate system calls to malicious executables, achieving persistence and potential privilege escalation. This rule monitors for registry value creation or modification in keys related to shell open commands for MS-settings, MSC files, or executables.
Detects when a browser desktop shortcut (.lnk file) is modified by a setup or update executable, which could indicate a Potentially Unwanted Program (PUP) injecting malicious arguments or redirecting the browser to an attacker-controlled gateway upon launch.
Detects modifications to COM InprocServer32 registry keys under HKEY_CURRENT_USER. This activity is often associated with COM hijacking, a technique used by adversaries to achieve persistence or execute malicious code when a hijacked COM object is invoked by legitimate applications. The rule specifically flags suspicious or non-Microsoft COM registrations, particularly those pointing to files within the user's AppData/Local directory.
Page 4 of 8