Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects persistence mechanisms used by The Gentlemen ransomware, specifically the creation of malicious scheduled tasks (UpdateUser, UpdateSystem, or gentlemen_system) and modification of registry Run keys (GupdateS or GupdateU). The rule also monitors for the presence of the operator password string 'G7Vz9eyG' within command line arguments.
Detects persistence establishment for the NetSupport Manager remote access tool (client32.exe) via common Windows techniques including registry run keys, Winlogon configuration, service creation, and scheduled tasks. This activity is often associated with the abuse of legitimate RMM software as a covert remote access implant, frequently following initial access via PowerShell or script-based loaders.
This rule detects the creation of a file within the SysWOW64 directory followed by an immediate modification or creation of a Windows Run registry key within a 10-minute window. This behavior is indicative of a persistence mechanism where a malicious file is dropped to a system directory and registered for execution at system startup or user logon.
This rule detects the creation of executable files (.exe or .dll) within the 'C:\Windows\SysWOW64\' directory by processes other than trusted Windows OS installation or servicing components. This activity is indicative of potential malware staging, side-loading, or persistence mechanisms where an adversary drops malicious payloads into a trusted system directory to evade detection.
Detects unauthorized or suspicious persistence attempts where Windows Package Manager (WinGet) configuration processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe) write to the Windows 'Run' registry keys in HKLM. This behavior can be abused to execute malicious code automatically at system startup.
Detects persistence and execution abuse within hidden IDE/AI assistant workspace directories (e.g., .vscode, .cursor, .claude). The rule monitors for the creation or modification of configuration files used for automated task execution and identifies process execution patterns originating from these directories that invoke downloaders (curl, wget) or decoders (base64) to fetch or execute payloads.
This rule detects the creation, modification, or renaming of .lnk shortcut files within the Windows Startup folders (both current user and roaming appdata). It then correlates this activity with the execution of AutoIt3.exe or processes identified as 'AutoIt' that are running scripts with .a3x or .au3 extensions, which are commonly used for persistence and execution of malicious automation scripts.
Detects modifications to Windows Registry persistence locations (Run, RunOnce, Winlogon Shell/Userinit) where the assigned executable path is located within high-risk directories such as Temp, AppData, or Users Public folders. This is a common technique used by malware for persistence.
This rule detects potential persistence mechanisms involving the creation of 'Locked' registry keys within Software\Classes and subsequent use of Run registry keys that reference 'Locked://' URIs. It also identifies suspicious execution of rundll32.exe utilizing specific CLSID-based command line arguments associated with the '{CFDC57BA-1705-45AF-BA10-EFC3D592982B}' identifier, often linked to malicious activity patterns.
Detects persistence attempts on Windows by monitoring for modifications to common Registry Run/RunOnce keys or the creation of executable files within the user startup directory. The rule excludes common legitimate processes like msiexec.exe, trustedinstaller.exe, and explorer.exe to minimize false positives.
Detects persistence modification via Registry Run/RunOnce keys or the addition of suspicious files to the Windows Startup folder. The rule specifically monitors for registry values pointing to common volatile directories, script extensions, or suspicious command-line interpreters. It also flags new executables or scripts being written directly into startup directory paths. This rule covers both direct registry manipulation and startup folder placement, often associated with malware or adversary persistence mechanisms.
Detects the unauthorized creation of script or executable files in the Windows Startup directory by .NET or Python runtime processes, specifically targeting the exploitation pattern of CVE-2026-25592. This vulnerability allows an AI agent host to bypass sandbox isolation and write files to the host filesystem, potentially establishing persistence.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects the abuse of the Windows Scripted Diagnostics framework (sdiagnhost.exe) by the Antino threat actor. The attack leverages sdiagnhost.exe to proxy the execution of a malicious script (result.ps1) that subsequently establishes persistence by creating a Registry Run key (GatherOSStateKit). The rule correlates the execution of the scripted diagnostic package with the specific registry modification event within a 5-minute window.
Detects a suspicious sequence of events where a process modifies a Windows Registry Run key to ensure execution at logon, followed shortly by the same executable file being copied into the current user's startup folder. This pattern is often used by malware to establish persistence.
Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.
This rule monitors for persistence mechanisms by detecting modifications to Windows Registry Run/RunOnce keys or the creation of files within the Windows Startup folder. It specifically flags instances where the executable or script being registered resides in high-risk directories such as Temp, AppData, or Downloads, and correlates these events with recent process execution to confirm the persistence activity.
This rule detects modifications to Windows Registry 'Run' or 'RunOnce' keys where the configured value points to a file located in common user-writable or temporary directories (AppData, Temp, ProgramData) with an executable extension (.exe, .dll, .scr, .bat, .vbs, .ps1, .cmd). This pattern is a common technique used by adversaries to establish persistence by ensuring malicious code executes automatically upon user login or system startup.
Page 5 of 59