Access To .Reg/.Hive Files By Uncommon Applications
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.
Hunting test file_access windows - - frack113 2023-09-15 2024-07-29 337a31c6-46c4-46be-886a-260d7aa78cac
1 Activate Suppression of Windows Security Center Notifications
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
1 Add DisallowRun Execution to Registry
Detect set DisallowRun to 1 to prevent user running specific computer program
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 275641a5-a492-45e2-a817-7c81e9d9d3e9
1 Allow RDP Remote Assistance Feature
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
1 Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-02-28 2025-10-22 6c8fbee5-dee8-49bc-851d-c3142d02aa47
3 APT29 Google Update Service Install
This method detects malicious services mentioned in APT29 report by FireEye. (...)
Unsupported unsupported process_creation windows WinEventLog System - Thomas Patzke 2017-11-01 2022-03-21 c069f460-2b87-4010-8dcf-e45bab362624
1 Splunk
Attacker Tools On Endpoint
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco - Bhavin Patel, Splunk, sventec, Github Community 2021-07-12 2026-09-22 a51bfe1a-94f0-48cc-b4e4-16a110145893
- Azure AD Health Monitoring Agent Registry Keys Access
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)
Generic test - windows WinEventLog Security - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC 2021-08-26 2022-10-09 ff151c33-45fa-475d-af4f-c2f93571f4fe
2 Azure AD Health Service Agents Registry Keys Access
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)
Generic test - windows WinEventLog Security - Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC 2021-08-26 2022-10-09 1d2ab8ac-1a01-423b-9c39-001510eae8e8
2 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 Blackbyte Ransomware Registry
Detects specific windows registry modifications made by BlackByte ransomware variants. (...)
Emerging test registry_set windows Sysmon · WinEventLog Security - frack113 2022-01-24 2025-10-21 83314318-052a-4c90-a1ad-660ece38d276
2 Blue Mockingbird
Attempts to detect system changes made by Blue Mockingbird
Emerging test process_creation windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick) 2020-05-14 2022-10-09 c3198a27-23a0-4c2c-af19-e5328d49680e
1 Blue Mockingbird - Registry
Attempts to detect system changes made by Blue Mockingbird
Emerging test registry_set windows Sysmon · WinEventLog Security - Trent Liffick (@tliffick) 2020-05-14 2023-08-17 92b0b372-a939-44ed-a11b-5136cf680e27
1 Certificate Exported Via Certutil.EXE
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) 2023-02-15 2024-03-05 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
1 Splunk
CertUtil With Decode Argument
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-03-25 2026-10-02 bfe94226-8c10-11eb-a4b3-acde48001122
5 Change the Fax Dll
Detect possible persistence using Fax DLL load when service restart
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-07-17 2022-12-30 9e3357ba-09d4-4fbd-a7c5-ad6386314513
2 Change User Account Associated with the FAX Service
Detect change of the user account associated with the FAX service to avoid the escalation problem.
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-07-17 2022-12-30 e3fdf743-f05b-4051-990a-b66919be1743
2 Splunk
Cisco Secure Firewall - Lumma Stealer Activity
This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk, Talos NTDR 2025-04-16 2026-05-13 96bce783-c22e-4e48-8cf1-3eb2794c5083
1 Splunk
Cisco Secure Firewall - Repeated Malware Downloads
The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-09 2026-09-22 aeff2bb5-3483-48d4-9be8-c8976194be1e
1 Splunk
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-16 2026-05-13 a4c76d0a-56b6-44be-814b-939746c4d406
1 ClickOnce Trust Prompt Tampering
Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.
Generic test registry_set windows Sysmon · WinEventLog Security - @SerkinValery, Nasreddine Bencherchali (Nextron Systems) 2023-06-12 2023-08-17 ac9159cc-c364-4304-8f0a-d63fc1a0aabb
2 Splunk
CMD Echo Pipe - Escalation
The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)
Generic stable process_creation windows Sysmon · WinEventLog Security · CrowdStrike - Michael Haag, Splunk 2021-05-27 2026-05-13 eb277ba0-b96b-11eb-b00e-acde48001122
2 CobaltStrike Service Installations - Security
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)
Generic test service windows WinEventLog Security - Florian Roth (Nextron Systems), Wojciech Lesicki 2021-05-26 2022-11-27 d7a95147-145f-4678-b85d-d1ff4a3bb3f6
3 CobaltStrike Service Installations - System
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)
Generic test service windows WinEventLog System - Florian Roth (Nextron Systems), Wojciech Lesicki 2021-05-26 2022-11-27 5a105d34-05fc-401e-8553-272b45c1522d
3 ConvertTo-SecureString Cmdlet Usage Via CommandLine
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton 2020-10-11 2023-02-01 74403157-20f5-415d-89a7-c505779585cf
2 CosmicDuke Service Installation
Detects the installation of a service named "javamtsup" on the system. (...)
Emerging test service windows WinEventLog Security - Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update) 2017-03-27 2022-10-09 cb062102-587e-4414-8efa-dbe3c7bf19c6
1 CrashControl CrashDump Disabled
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Generic test registry_set windows Sysmon · WinEventLog Security - Tobias Michalski (Nextron Systems) 2022-02-24 2023-08-17 2ff692c2-4594-41ec-8fcb-46587de769e0
1 Creation Of Pod In System Namespace
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)
Generic test - - Kubernetes Audit · Kubernetes - Leo Tsaousis (@laripping) 2024-03-26 — a80d927d-ac6e-443f-a867-e8d6e3897318
1 Splunk
Curl Execution with Percent Encoded URL
The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)
Anomaly stable process_creation windows · linux CrowdStrike · Sysmon · WinEventLog Security - Nasreddine Bencherchali, Splunk 2026-03-03 2026-05-13 9a8d5516-4c5e-11ef-9d42-acde48001122
4 CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...)
Emerging test registry_set windows Sysmon · WinEventLog Security EagleEye Team, Florian Roth (Nextron Systems), NVISO 2020-05-13 2024-03-25 7ec912f2-5175-4868-b811-ec13ad0f8567
1 Decode Base64 Encoded Text
Detects usage of base64 utility to decode arbitrary base64-encoded text
Generic test process_creation linux Sysmon - Daniil Yugoslavskiy, oscd.community 2020-10-19 2021-11-27 e2072cab-8c9a-459b-b63c-40ae79e27031
1 Decode Base64 Encoded Text -MacOs
Detects usage of base64 utility to decode arbitrary base64-encoded text
Generic test process_creation macos - - Daniil Yugoslavskiy, oscd.community 2020-10-19 2022-11-26 719c22d7-c11a-4f2c-93a6-2cfdd5412f68
1 Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
Detects suspicious DACL modifications to deny access to a service that affects critical trustees. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Jonhnathan Ribeiro, oscd.community 2020-10-16 2023-02-28 99cf1e02-00fb-4c0d-8375-563f978dfd37
3 Devcon Execution Disabling VMware VMCI Device
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)
Generic experimental process_creation windows Sysmon · WinEventLog Security - Matt Anderson, Dray Agha, Anna Pham (Huntress) 2026-01-02 — 85f520e7-6f5e-43ca-874c-222e5bf9c0de
4 DHCP Callout DLL Installation
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Dimitrios Slamaris 2017-05-15 2023-08-17 9d3436ef-9476-4c43-acca-90ce06bdf33a
3 Disable Internal Tools or Feature in Registry
Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...)
Generic test registry_set windows Sysmon · WinEventLog Security - frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec 2022-03-18 2025-06-04 e2482f8d-3443-4237-b906-cc145d87a076
6 Splunk
Disable Registry Tool
The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-03-31 2026-10-02 cd2cf33c-9201-11eb-a10a-acde48001122
2 Disable Security Events Logging Adding Reg Key MiniNt
Detects the addition of a key 'MiniNt' to the registry. (...)
Generic test registry_event windows Sysmon · WinEventLog Security - Ilyas Ochkov, oscd.community 2019-10-25 2021-11-27 919f2ef0-be2d-4a7a-b635-eb2b41fde044
2 Splunk
Disable Security Logs Using MiniNt Registry
The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-10-05 2026-05-13 39ebdc68-25b9-11ec-aec7-acde48001122
1 Splunk
Disable Show Hidden Files
The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)
Anomaly stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-03-31 2026-05-13 6f3ccfa2-91fe-11eb-8f9b-acde48001122
1 Splunk
Disable Windows App Hotkeys
The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-05-07 2026-05-13 1490f224-ad8b-11eb-8c4f-acde48001122
1 Disable Windows Security Center Notifications
Detect set UseActionCenterExperience to 0 to disable the Windows security center notification
Generic test registry_set windows Sysmon · WinEventLog Security - frack113 2022-08-19 2023-08-17 3ae1a046-f7db-439d-b7ce-b8b366b81fa6
1 Splunk
Disabling CMD Application
The following analytic detects modifications to the registry that disable the CMD prompt application. (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-03-31 2026-10-02 ff86077c-9212-11eb-a1e6-acde48001122
2 Splunk
Disabling ControlPanel
The following analytic detects registry modifications that disable the Control Panel on Windows systems. (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-03-31 2026-05-13 6ae0148e-9215-11eb-a94a-acde48001122
1 Splunk
Disabling NoRun Windows App
The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-03-31 2026-05-13 de81bc46-9213-11eb-adc9-acde48001122
2 DNS-over-HTTPS Enabled by Registry
Detects when a user enables DNS-over-HTTPS. (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Austin Songer 2021-07-22 2023-08-17 04b45a8a-d11d-49e4-9acc-4a1b524407a5
4 Driver Load From A Temporary Directory
Detects a driver load from a temporary directory
Generic test driver_load windows Sysmon - Florian Roth (Nextron Systems) 2017-02-12 2021-11-27 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
1 Enable LM Hash Storage
Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)
Generic test registry_set windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-12-15 — c420410f-c2d8-4010-856b-dffe21866437
3 Enable LM Hash Storage - ProcCreation
Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-12-15 2023-12-22 98dedfdd-8333-49d4-9f23-d7018cccae53
3 Splunk
Enable WDigest UseLogonCredential Registry
The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. (...)
Generic stable registry_event windows Sysmon - Teoderick Contreras, Splunk, Steven Dick 2021-10-05 2026-10-09 0c7d8ffe-25b1-11ec-9f39-acde48001122
3