Browse Rules

Search and filter across all detection sources

1,544 rules

wazuh low xml

Cannot read registry, registry keys missing

Cannot read registry, registry keys missing
chronicle unknown yara-l

malware_zeppelin_registry

Zeppelin registry key writing
yara unknown yara

win_registry [capabilities]

Affect system registries
wazuh low xml

Unable to load registry

Unable to load registry
yara unknown yara

disable_registry [antidebug_antivm]

Disable Registry editor
sentinel high kql

Registries Alerts for Prancer

'High severity registry alerts found by Prancer.'

hayabusa high sigma

SAM Registry Hive Handle Request

Detects handles requested to SAM registry hive
sagan critical other

[WINDOWS-SYSMON] Registry Hive Dump

[WINDOWS-SYSMON] Registry Hive Dump
sigma high sigma

SAM Registry Hive Handle Request

Detects handles requested to SAM registry hive
hayabusa high sigma

Registry Persistence Mechanisms in Recycle Bin

Detects persistence registry keys for Recycle Bin
sigma high sigma

Registry Persistence Mechanisms in Recycle Bin

Detects persistence registry keys for Recycle Bin
hayabusa medium sigma

Disable Privacy Settings Experience in Registry

Detects registry modifications that disable Privacy Settings Experience
hayabusa high sigma

Registry Persistence Mechanisms in Recycle Bin

Detects persistence registry keys for Recycle Bin
sagan medium other

[EXTRAHOP] New Remote Registry Modification Attempt

[EXTRAHOP] New Remote Registry Modification Attempt
sagan medium other

[EXTRAHOP] New Windows Registry Enumeration Attempt

[EXTRAHOP] New Windows Registry Enumeration Attempt
sagan medium other

[EXTRAHOP] New Windows Registry Modification Attempt

[EXTRAHOP] New Windows Registry Modification Attempt
sagan medium other

[EXTRAHOP] Registry Hive Transfer over SMB

[EXTRAHOP] Registry Hive Transfer over SMB
sagan medium other

[EXTRAHOP] Registry Hive Transfer over SMB

[EXTRAHOP] Registry Hive Transfer over SMB
sagan medium other

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner
sagan medium other

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner

[WINDOWS-MISC] MsiInstaller - RegWork - Registry clearner
sagan critical other

[WINDOWS-SECURITY] Atera Registry Key Deleted

[WINDOWS-SECURITY] Atera Registry Key Deleted
sigma medium sigma

Disable Privacy Settings Experience in Registry

Detects registry modifications that disable Privacy Settings Experience
wazuh low xml

Error generated by registry user name definition

Error generated by registry user name definition
wazuh low xml

Cannot interpret user name specified in registry

Cannot interpret user name specified in registry
elastic-protections high eql

Suspicious Registry Symbolic Link

Identifies the creation of registry symbolic link by an unusual process. This may indicate an attempt to elevate privileges via hijacking privileged registry read operations using a malicious registry symbolic link.