Detection rules › By catalog entry

Defender-DeviceRegistryEvents

Catalog entry	Rules
any	2
RegistryKeyDeleted	5
RegistryValueSet	10
RegistryValueDeleted	5
RegistryKeyRenamed	5

any

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

MosaicLoader severity high T1685
Registry Run Keys - Suspicious Registry Run Keys T1547,T1547.001

RegistryKeyDeleted

5 detection rules reference this catalog entry. View catalog entry.

Kusto (5)

Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112,T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548,T1548.002

RegistryValueSet

10 detection rules reference this catalog entry. View catalog entry.

Kusto (10)

COM Registry Key Modified to Point to File in Color Profile Folder severity medium T1574
Component Object Model Hijacking - Vault7 trick severity medium T1546,T1546.015
Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112,T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
MosaicLoader severity high T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548,T1548.002
Registry Run Keys - Suspicious Registry Run Keys T1547,T1547.001
Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)

RegistryValueDeleted

5 detection rules reference this catalog entry. View catalog entry.

Kusto (5)

Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112,T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548,T1548.002

RegistryKeyRenamed

5 detection rules reference this catalog entry. View catalog entry.

Kusto (5)

Detect Print Processors Registry Driver Key Creation/Modification severity medium T1547
Detect Registry Run Key Creation/Modification severity medium T1112,T1547
Detect Windows Allow Firewall Rule Addition/Modification severity medium T1685
Detect Windows Update Disabled from Registry severity medium T1685
Potential Fodhelper UAC Bypass (ASIM Version) severity medium T1548,T1548.002

Back to all Defender-DeviceRegistryEvents catalog entries