Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,693 detections
Filters
Last updated
All Time
Detection languages
2,745
1,499
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,666
71
52
31
29
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
2,448
1,976
1,633
1,400
855
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
This rule detects attempts to enumerate installed software versions on a Windows system using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query the registry for software version information, often found under `HKEY_LOCAL_MACHINE\Software\` paths and requesting the `svcVersion` value. This activity can be indicative of an adversary trying to identify vulnerable software or understand the system's security posture.
Detects applications attempting to modify the Windows Registry to disable write protection for storage devices. This activity can precede ransomware attacks or other malicious data manipulation, as observed with certain threat groups.
Detects `regsvr32.exe` execution attempting to download and install DLLs from a remote IP address. This technique is often used for defense evasion and bypassing application control by leveraging a trusted Microsoft binary to execute arbitrary code.
Detects attempts to tamper with the PowerShell execution policy by modifying registry keys via the command line. This technique is often used by adversaries to bypass script signing requirements, allowing the execution of unsigned or malicious PowerShell scripts.
Detects the creation of scheduled tasks using `schtasks.exe` that are configured to run once at exactly 00:00 and execute suspicious commands or scripts. The suspicious commands include common scripting engines (wscript, cscript, powershell), WMI, regsvr32, or executables located in the AppData directory. This pattern is often used by adversaries for persistence or execution at a specific, often stealthy, time.
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
This rule detects the execution of a new process where the parent process is `vsjitdebugger.exe`, the Microsoft Visual Studio Just-In-Time Debugger. Adversaries may abuse this legitimate, signed binary to proxy the execution of malicious code, thereby evading defenses that trust signed executables. The rule includes exclusions for common legitimate child processes of `vsjitdebugger.exe` to reduce false positives.
This rule detects the execution of 'tapinstall.exe', which is used to install TAP (Tunnel Adapter) drivers. While legitimate for VPN software like OpenVPN, Avast SecureLine VPN, and ProtonVPN, its execution outside of these known contexts could indicate an adversary preparing for data exfiltration using tunneling techniques. TAP drivers create virtual network interfaces, which can be leveraged to establish covert communication channels or bypass network segmentation.
Detects the execution of "WerFault.exe" with the "-pr" command-line flag. This specific command-line argument is used to run files stored in the ReflectDebugger registry key, which can be abused by adversaries to masquerade execution flow and achieve persistence or defense evasion by leveraging a legitimate Windows error reporting process.
Detects the execution of 'whoami.exe' with the '/groups' or '-groups' command-line flag to enumerate group membership for the current user. This activity is often performed by attackers during the discovery phase to understand the privileges of a compromised account.
Detects the execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl files via winrm.vbs and a potentially renamed cscript.exe. This technique is used to bypass Application Whitelisting (AWL) by leveraging legitimate Windows scripts.
This rule detects the creation of a WMI script event consumer by monitoring for the execution of 'scrcons.exe' with 'svchost.exe' as its parent process. This specific process relationship is indicative of WMI persistence mechanisms, where a script event consumer is registered to execute code when certain WMI events occur. Adversaries often leverage WMI event consumers for persistence and privilege escalation.
Detects when the WmiPrvSE.exe process spawns a new process. This activity can be indicative of malicious use of Windows Management Instrumentation (WMI) for execution, as WmiPrvSE.exe is a legitimate process that hosts WMI provider plug-ins. Adversaries often abuse WMI to execute commands or maintain persistence.
This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.
Detects registry persistence techniques leveraging the GlobalFlags and SilentProcessExit keys within the Image File Execution Options (IFEO) registry path. Adversaries can modify these registry keys to execute arbitrary code when a specific application starts or exits, providing a stealthy method for persistence and privilege escalation.
This rule detects attempts to establish persistence and evade defenses by registering a new Subject Interface Package (SIP) provider. Attackers can modify specific registry keys related to cryptographic providers to redirect signature validation functions to malicious DLLs. This allows them to bypass application control mechanisms by making the system trust unsigned or malicious code as legitimately signed. The rule specifically looks for modifications to registry paths associated with Microsoft Cryptography Providers and OID EncodingType, where the 'Dll' or '$DLL' values are being set, while filtering out known legitimate SIP registrations by the OS or specific software like WINTRUST.DLL and mso.dll. It also filters out specific legitimate activity related to poqexec.exe and PsfSip.dll.
This rule detects User Account Control (UAC) bypass attempts by monitoring specific registry key modifications related to `sdclt.exe`. Attackers can manipulate these registry keys to hijack the execution flow of `sdclt.exe`, a legitimate Windows utility, to run arbitrary code with elevated privileges without triggering a UAC prompt. The rule specifically looks for modifications to `Software\Classes\exefile\shell\runas\command\isolatedCommand` or `Software\Classes\Folder\shell\open\command\SymbolicLinkValue` with a specific pattern indicating a UAC bypass technique.
Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content from it. This technique has been observed in malicious LNK files, often used for initial access or execution of payloads from remote shares.
This rule detects the execution of `Cmdl32.exe` with the `/vpn` and `/lan` flags. Attackers can abuse this legitimate Windows utility to download arbitrary files by providing a malicious configuration file. The rule advises inspecting the location and content of the file passed as an argument to determine if it is suspicious.
Page 306 of 319