Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
21
10
8
5
3
Contributors
22
9
6
5
3
Categories
28
24
14
9
6
Platforms
52
2
2
2
2
Products / Services
25
17
7
3
3
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects the creation of scheduled tasks named 'RageGuard' or utilizing 'win_guard' binary paths in suspicious directories (Temp, AppData, ProgramData), correlated with concurrent registry modifications to Winlogon (Shell/Userinit) or Image File Execution Options (Debugger) using the same binary, indicative of the TrymeLocker ransomware persistence mechanism.
Detects unauthorized modifications to common Windows persistence registry keys, including Winlogon shell/userinit hijacking, Image File Execution Options (IFEO) debugger abuse, and known malicious Run key entries.
Detects unauthorized modifications to the Winlogon registry keys 'Shell' and 'Userinit'. These keys are commonly abused by adversaries to achieve persistence by executing malicious binaries or scripts upon user logon. The rule excludes modifications by the SYSTEM account and flags deviations from standard Windows configuration values (e.g., non-standard Shell values, or Userinit values that do not point to the expected system file).
Detects unauthorized modifications to the Winlogon Shell or Userinit registry keys. The rule specifically alerts when these keys are updated to point to a binary located outside of standard Windows system directories (System32 or Program Files), which is a common persistence technique used by the TrymeLocker ransomware and other malicious software to execute code at user logon.
Detects suspicious modifications to Windows registry keys associated with logon script execution, such as 'UserInitMprLogonScript' or 'Userinit'. These locations are frequently abused by adversaries to achieve persistence by forcing the execution of malicious scripts or binaries upon user logon. The rule excludes modifications made by standard Microsoft Windows processes to reduce noise.
Detects modifications or creations of registry values within common Windows auto-start locations, specifically the 'Run' and 'Winlogon' keys. These locations are frequently abused by adversaries to maintain persistence on a host. The rule excludes common, legitimate installer and administration processes to reduce noise.
Detects modifications to the Winlogon Shell or Userinit registry keys. These keys define the processes that run upon user logon. Adversaries modify these values to achieve persistence by pointing them to malicious binaries or scripts, often identified in this rule by the string 'win_guard_'.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects modifications to the Winlogon Shell or Userinit registry values, which are critical autostart locations often abused for persistence. The rule filters out legitimate system processes and flags values that point to suspicious locations such as AppData, Temp, or ProgramData, or that do not point to the expected explorer.exe binary.
Detects LCRYX ransomware establishing persistence by modifying the Winlogon Shell registry key and creating multiple VBScript-based entries in Windows Run keys. The rule monitors for registry modifications targeting known persistence locations with suspicious scripts as values.
Detects suspicious Registry modifications made by scripting hosts (wscript.exe, cscript.exe) often associated with malware persistence. This includes unauthorized modifications to Winlogon shell keys, addition of known malicious script names to Run keys, installation of scripts into startup paths, and Image File Execution Options (IFEO) debugger hijacking for cmd.exe.
This rule detects unauthorized modifications to common Windows persistence registry keys, including 'Run' keys, the 'Winlogon Shell' value, and 'Image File Execution Options' (IFEO) debugger values. These modifications are commonly used by adversaries to establish persistence or intercept process execution.
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects attempts to establish persistence by modifying specific registry keys known to be used for auto-starting applications or malicious code. It specifically monitors for changes to 'AppInit_DLLs', 'LSAProviders', 'SecurityProviders', and 'WinlogonNotifyPackages' within Security Event ID 4657 (A registry value was modified).
This rule detects network traffic on TCP port 445 (SMB) containing the strings "Winlogon" and "Userinit" (case-insensitive). This pattern is indicative of a potential modification to the Winlogon Helper DLL for persistence, as Winlogon and Userinit are key components in the Windows logon process. An attacker might modify a helper DLL to execute malicious code during system startup.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects file creation events associated with the Mini Shai-Hulud npm/PyPI supply-chain attack campaign targeting TanStack, Mistral AI, OpenSearch, and Guardrails AI packages.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
This rule detects specific DCE-RPC function calls that are indicative of persistence techniques on a remote Windows system. The detected operations include adding print monitors or print processors, and creating processes with logon credentials, which can be abused by adversaries to maintain access or execute code.
This rule detects the creation of a suspicious child process by 'userinit.exe'. Userinit.exe is a legitimate Windows process responsible for initializing the user environment during logon. Malicious actors may attempt to leverage or compromise this process to execute arbitrary code, establish persistence, or elevate privileges. The rule specifically filters out legitimate child processes like 'explorer.exe' and processes related to netlogon to reduce false positives.
This rule detects modifications to the Winlogon Notify registry key to establish persistence. Adversaries may abuse Winlogon's features to execute DLLs when a user logs in. The rule specifically looks for changes to the `\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon` registry key where the `Details` field indicates a DLL file (`.dll`) is being set.
Page 2 of 3