Browse Rules

Search and filter across all detection sources

685 rules

sagan critical other

[WINDOWS-SYSMON] Registry Hive Dump

[WINDOWS-SYSMON] Registry Hive Dump
sagan medium other

[EXTRAHOP] New Windows Registry Enumeration Attempt

[EXTRAHOP] New Windows Registry Enumeration Attempt
sagan medium other

[EXTRAHOP] New Windows Registry Modification Attempt

[EXTRAHOP] New Windows Registry Modification Attempt
sagan medium other

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner
sagan medium other

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner
sagan critical other

[WINDOWS-SECURITY] Atera Registry Key Deleted

[WINDOWS-SECURITY] Atera Registry Key Deleted
sagan unknown other

[WINDOWS-SECURITY] Batch File Added to Registry

[WINDOWS-SECURITY] Batch File Added to Registry
sagan unknown other

[WINDOWS-SECURITY] Windows Registry - Restricted Admin Mode Enabled (Windows Security Audit) - Critical

[WINDOWS-SECURITY] Windows Registry - Restricted Admin Mode Enabled (Windows Security Audit) - Critical
hayabusa high sigma

Disable Windows Defender Functionalities Via Registry Keys

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
sigma high sigma

Disable Windows Defender Functionalities Via Registry Keys

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
sagan high other

[WINDOWS-POWERSHELL] Microsoft Defender Security Registry Access

[WINDOWS-POWERSHELL] Microsoft Defender Security Registry Access
sagan high other

[WINDOWS-POWERSHELL] Registry Query for WDigest UseLogonCredential

[WINDOWS-POWERSHELL] Registry Query for WDigest UseLogonCredential
sagan critical other

[WINDOWS-SECURITY] Sticky Key Backdoor Registry Addition

[WINDOWS-SECURITY] Sticky Key Backdoor Registry Addition
sagan high other

[WINDOWS-SYSMON] Backstab Registry ETW Provider Modification

[WINDOWS-SYSMON] Backstab Registry ETW Provider Modification
sagan critical other

[WINDOWS-SYSMON] Blackbasta default icon registry entry

[WINDOWS-SYSMON] Blackbasta default icon registry entry
sagan critical other

[WINDOWS-SYSMON] Blackbasta default icon registry entry

[WINDOWS-SYSMON] Blackbasta default icon registry entry
sagan critical other

[WINDOWS-SYSMON] CMD set in Registry Key

[WINDOWS-SYSMON] CMD set in Registry Key
sagan critical other

[WINDOWS-SYSMON] PS1 set in Registry Key

[WINDOWS-SYSMON] PS1 set in Registry Key
sagan critical other

[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta

[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta
sagan critical other

[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta

[WINDOWS-SYSMON] Safeboot Registry Entry - Possible Blackbasta
sagan unknown other

[WINDOWS-SECURITY] Windows Registry - Restricted Admin Outbound Credentials Enabled (Windows Security Audit) - Critical

[WINDOWS-SECURITY] Windows Registry - Restricted Admin Outbound Credentials Enabled (Windows Security Audit) - Critical
sagan high other

[WINDOWS-POWERSHELL] Windows Registry - Restricted Admin Mode Enabled via PowerShell - Critical

[WINDOWS-POWERSHELL] Windows Registry - Restricted Admin Mode Enabled via PowerShell - Critical
sagan unknown other

[WINDOWS-SYSMON] Windows Registry - Restricted Admin Mode Enabled (Sysmon RegistryEvent) - Critical

[WINDOWS-SYSMON] Windows Registry - Restricted Admin Mode Enabled (Sysmon RegistryEvent) - Critical
hayabusa high sigma

Disable Windows Defender Functionalities Via Registry Keys

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
sagan unknown other

[WINDOWS-SECURITY] Batch File Inserted Into The Registry

[WINDOWS-SECURITY] Batch File Inserted Into The Registry