Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
203 detections
Filters
Last updated
All Time
Detection languages
76
72
13
12
8
Contributors
34
27
25
20
18
Categories
89
65
45
23
22
Platforms
173
30
21
6
3
Products / Services
42
40
26
7
5
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
1
1
1
IDS Classtypes
4
3
IDS Protocols
4
2
1
Detects malicious installer packages with custom actions for persistence
Detects modifications to Windows Active Setup registry keys involving suspicious StubPath values or the creation of the specific {RAGE-MASTER} registry key associated with TrymeLocker malware. This technique is used to maintain persistence by executing malicious code upon user login.
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
This rule detects the execution and creation of suspicious files named 'winupdate.exe' or 'SLaunch.exe' within the AppData cache directory, or processes involving 'YutaCore.dll' or a specific local host URL. It also checks for the execution of known malicious file hashes associated with this behavior.
Detects the creation of scheduled tasks using schtasks.exe that point to the ProgramData directory, which is a common persistence location for malware like SystemBC. The rule excludes common, benign software installers and updaters that frequently use this directory to avoid false positives.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
Detects replacement of critical system binaries for persistent code execution
Detects the creation of files with filenames '.store' or '.host' (or any dot-prefixed file) within the Windows TEMP directory by specific processes (python.exe or chost.exe). This behavior is observed in certain npm-based Remote Access Trojans (RATs) to drop configuration and state files.
Detects the creation of files with filenames '.store' or '.host' (or any dot-prefixed file) within the Windows TEMP directory by specific processes (python.exe or chost.exe). This behavior is observed in certain npm-based Remote Access Trojans (RATs) to drop configuration and state files.
This rule detects unauthorized modifications to the ImagePath registry value for the Windows Update service (wusvc). By changing this path to a non-standard executable or DLL, an attacker can achieve persistence and elevate privileges by having their code execute when the service starts.
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
Detects the creation of hidden executables deep within the AppData\Roaming directory, a characteristic behavior of PureHVNC for persistence.
This rule detects remote modification attempts of the 'Run' key within the Windows Registry, which is commonly used for persistence by malware and legitimate applications to automatically start programs when a user logs in. The detection specifically looks for network traffic on port 445 (SMB) containing the string 'CurrentVersion\Run', indicating an attempt to interact with this registry path remotely.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
This rule generates a comprehensive forensic timeline for a specific executable file, analyzing its origin (file creation/drops), execution context (process creation and child processes), network communications (outbound connections), and persistence mechanisms (registry modifications for run keys/startup and scheduled task creation/updates). It correlates events across different data sources based on the executable's file name or SHA256 hash.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
This rule detects attempts to add an autostart entry via a remote registry write operation targeting TCP port 445 (SMB). It specifically looks for network traffic containing the strings "Run", "HKCU" (HKEY_CURRENT_USER), and "\Software\Microsoft\Windows", indicating a modification to the current user's run keys for persistence. This activity is often associated with malware or adversaries establishing persistence on a compromised Windows system.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
Page 5 of 10