Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
566
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
429
291
252
179
Platforms
1,209
21
17
3
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,235
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects the creation or modification of a registry run key entry named 'DadaBank' within 'Software\Microsoft\Windows\CurrentVersion\Run'. This specific registry modification is associated with the LotusLite dropper, used by the Mustang Panda threat group, to establish persistence on a compromised system.
Detects modification of registry Run keys for autostart persistence
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects modification of LNK shortcut files in startup folders for autostart persistence
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
Detects multiple registry value set events where the registry value data contains keywords like 'ransom' or 'payment', or the registry key contains 'Run'. This behavior can indicate ransomware activity attempting to establish persistence or communicate its demands.
Detects post-reboot persistence mechanism established by the Mustang Panda PlugX variant, utilizing a 'G Data' Run key and a suspicious staging path pointing to 'Avk.exe'. This rule specifically looks for registry key creations or value sets in the Run key where the value name is 'G Data' or the value data contains 'GData\Avk.exe'.
Detects process execution originating from the suspicious '%LOCALAPPDATA%\MicrosoftSystem64' directory, which is used as a persistence mechanism by a North Korean-linked npm infostealer RAT.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
This rule detects the creation of new processes (Event ID 4688) where the command line contains keywords indicative of driver or kernel module installation or loading. It looks for combinations of terms like 'driver', 'kernel', 'sys' along with 'install' or 'load'. This activity can be a sign of rootkit installation or other malicious kernel-level modifications.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects the creation of Run or RunOnce registry keys being set with a specific "Update Drivers NVIDEO_" naming pattern. This behavior is indicative of a fileless .NET loader associated with a recent malspam campaign using masqueraded registry values to maintain stealthy persistence.
Detects the creation or modification of a registry value within the HKCU Run key that points to wscript.exe executing a .js file. This is the primary persistence mechanism for JS.MonoGlyphRAT to maintain a foothold on compromised US enterprise systems.
Detects the creation or modification of the 'WinDiagTrack' registry value within the Windows Run key, a known persistence mechanism used by the 10FXRAT malware. This rule specifically looks for actions that create or set registry values in 'Software\Microsoft\Windows\CurrentVersion\Run' with the name 'WinDiagTrack'.
Detects execution and persistence mechanisms associated with the
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
Page 41 of 59