Detection rules › By event
Microsoft-Windows-Sysmon Event ID 13
Sigma (276)
- Activate Suppression of Windows Security Center Notifications
- Add Debugger Entry To AeDebug For Persistence
- Add Debugger Entry To Hangs Key For Persistence
- Add DisallowRun Execution to Registry
- Add Port Monitor Persistence in Registry
- Allow RDP Remote Assistance Feature
- AMSI Disabled via Registry Modification
- Antivirus Filter Driver Disallowed On Dev Drive - Registry
- Atbroker Registry Change
- Blackbyte Ransomware Registry
- Blue Mockingbird - Registry
- Bypass UAC Using DelegateExecute
- Bypass UAC Using Event Viewer
- Bypass UAC Using SilentCleanup Task
- Change the Fax Dll
- Change User Account Associated with the FAX Service
- Change Winevt Channel Access Permission Via Registry
- Classes Autorun Keys Modification
- ClickOnce Trust Prompt Tampering
- CMSTP Execution Registry Event
- COM Hijack via Sdclt
- COM Hijacking via TreatAs
- COM Object Hijacking Via Modification Of Default System CLSID Default Value
- Command Executed Via Run Dialog Box - Registry
- Common Autorun Keys Modification
- CrashControl CrashDump Disabled
- Creation of a Local Hidden User Account by Registry
- CurrentControlSet Autorun Keys Modification
- CurrentVersion Autorun Keys Modification
- CurrentVersion NT Autorun Keys Modification
- Custom File Open Handler Executes PowerShell
- CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
- CVE-2021-31979 CVE-2021-33771 Exploits
- Default RDP Port Changed to Non Standard Port
- DHCP Callout DLL Installation
- Diamond Sleet APT Scheduled Task Creation - Registry
- Directory Service Restore Mode(DSRM) Registry Value Tampering
- Disable Administrative Share Creation at Startup
- Disable Exploit Guard Network Protection on Windows Defender
- Disable Internal Tools or Feature in Registry
- Disable Macro Runtime Scan Scope
- Disable Microsoft Defender Firewall via Registry
- Disable Privacy Settings Experience in Registry
- Disable PUA Protection on Windows Defender
- Disable Security Events Logging Adding Reg Key MiniNt
- Disable Tamper Protection on Windows Defender
- Disable Windows Defender Functionalities Via Registry Keys
- Disable Windows Event Logging Via Registry
- Disable Windows Firewall by Registry
- Disable Windows Security Center Notifications
- Disabled Windows Defender Eventlog
- Displaying Hidden Files Feature Disabled
- DLL Load via LSASS
- DLL ServerLevelPluginDll registration (Reg via Sysmon)
- DNS-over-HTTPS Enabled by Registry
- Driver Added To Disallowed Images In HVCI - Registry
- Enable LM Hash Storage
- Enable Local Manifest Installation With Winget
- Enable Microsoft Dynamic Data Exchange
- Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
- Enabling COR Profiler Environment Variables
- Esentutl Volume Shadow Copy Service Keys
- ETW Logging Disabled For rpcrt4.dll
- ETW Logging Disabled For SCM
- ETW Logging Disabled In .NET Processes - Sysmon Registry
- Execution DLL of Choice Using WAB.EXE
- FileFix - Command Evidence in TypedPaths
- FlowCloud Registry Markers
- Forest Blizzard APT - Custom Protocol Handler Creation
- Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
- Hide Schedule Task Via Index Value Tamper
- Hiding User Account Via SpecialAccounts Registry Key
- HybridConnectionManager Service Installation - Registry
- Hypervisor Enforced Paging Translation Disabled
- IE Change Domain Zone
- IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
- Impacket SMBexec service creation (registry)
- Internet Explorer Autorun Keys Modification
- Internet Explorer DisableFirstRunCustomize Enabled
- Kapeka Backdoor Autorun Persistence
- Kapeka Backdoor Configuration Persistence
- Leviathan Registry Key Activity
- Lolbas OneDriveStandaloneUpdater.exe Proxy Download
- Lsass Full Dump Request Via DumpType Registry Settings
- Macro Enabled In A Potentially Suspicious Document
- MaxMpxCt Registry Value Changed
- Microsoft Defender service components status disabled (Registry via Sysmon)
- Microsoft Office Protected View Disabled
- Microsoft Office Trusted Location Updated
- Mimikatz driver registration (Reg via Sysmon)
- Modification of IE Registry Settings
- Modify User Shell Folders Startup Value
- Narrator's Feedback-Hub Persistence
- NET NGenAssemblyUsageLog Registry Key Tamper
- NetNTLM Downgrade Attack - Registry
- Netsh helper DLL abuse (Reg via Sysmon)
- New Application in AppCompat
- New BgInfo.EXE Custom DB Path Registry Configuration
- New BgInfo.EXE Custom VBScript Registry Configuration
- New BgInfo.EXE Custom WMI Query Registry Configuration
- New DLL Added to AppCertDlls Registry Key
- New DLL Added to AppInit_DLLs Registry Key
- New DNS ServerLevelPluginDll Installed
- New File Association Using Exefile
- New Netsh Helper DLL Registered From A Suspicious Location
- New ODBC Driver Registered
- New PortProxy Registry Entry Added
- New Root or CA or AuthRoot Certificate to Store
- New RUN Key Pointing to Suspicious Folder
- New TimeProviders Registered With Uncommon DLL Name
- NTLM downgrade attack (Reg via SYSMON)
- OceanLotus Registry Activity
- Office Application Startup - Office Test
- Office Autorun Keys Modification
- Office Macros Warning Disabled
- OilRig APT Registry Persistence
- Old TLS1.0/TLS1.1 Protocol Version Enabled
- Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
- Outlook Macro Execution Without Warning Setting Enabled
- Outlook Security Settings Updated - Registry
- Outlook Task/Note Reminder Received
- Pandemic Registry Key
- Path To Screensaver Binary Modified
- Periodic Backup For System Registry Hives Enabled
- Persistence Via Disk Cleanup Handler - Autorun
- Persistence Via Hhctrl.ocx
- Persistence Via New SIP Provider
- Potential AMSI COM Server Hijacking
- Potential Attachment Manager Settings Associations Tamper
- Potential Attachment Manager Settings Attachments Tamper
- Potential AutoLogger Sessions Tampering
- Potential ClickFix Execution Pattern - Registry
- Potential CobaltStrike Service Installations - Registry
- Potential COLDSTEEL RAT Windows User Creation
- Potential COM Object Hijacking Via TreatAs Subkey - Registry
- Potential Credential Dumping Attempt Using New NetworkProvider - REG
- Potential Credential Dumping Via LSASS SilentProcessExit Technique
- Potential Encrypted Registry Blob Related To SNAKE Malware
- Potential EventLog File Location Tampering
- Potential KamiKakaBot Activity - Winlogon Shell Persistence
- Potential PendingFileRenameOperations Tampering
- Potential Persistence Using DebugPath
- Potential Persistence Via App Paths Default Property
- Potential Persistence Via AppCompat RegisterAppRestart Layer
- Potential Persistence Via AutodialDLL
- Potential Persistence Via CHM Helper DLL
- Potential Persistence Via Custom Protocol Handler
- Potential Persistence Via DLLPathOverride
- Potential Persistence Via Event Viewer Events.asp
- Potential Persistence Via Excel Add-in - Registry
- Potential Persistence Via GlobalFlags
- Potential Persistence Via Logon Scripts - Registry
- Potential Persistence Via LSA Extensions
- Potential Persistence Via Mpnotify
- Potential Persistence Via MyComputer Registry Keys
- Potential Persistence Via Netsh Helper DLL - Registry
- Potential Persistence Via New AMSI Providers - Registry
- Potential Persistence Via Outlook Home Page
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
- Potential Persistence Via Outlook Today Page
- Potential Persistence Via Scrobj.dll COM Hijacking
- Potential Persistence Via Shim Database In Uncommon Location
- Potential Persistence Via Shim Database Modification
- Potential Persistence Via TypedPaths
- Potential Persistence Via Visual Studio Tools for Office
- Potential PowerShell Execution Policy Tampering
- Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
- Potential PSFactoryBuffer COM Hijacking
- Potential Qakbot Registry Activity
- Potential Ransomware Activity Using LegalNotice Message
- Potential Raspberry Robin Registry Set Internet Settings ZoneMap
- Potential Registry Persistence Attempt Via DbgManagedDebugger
- Potential Registry Persistence Attempt Via Windows Telemetry
- Potential SentinelOne Shell Context Menu Scan Command Tampering
- Potential Signing Bypass Via Windows Developer Features - Registry
- Potential WerFault ReflectDebugger Registry Value Abuse
- Potentially Suspicious Command Executed Via Run Dialog Box - Registry
- Potentially Suspicious Desktop Background Change Via Registry
- Potentially Suspicious ODBC Driver Registered
- PowerShell as a Service in Registry
- PowerShell Logging Disabled Via Registry Key Tampering
- PowerShell Script Execution Policy Enabled
- PrinterNightmare Mimikatz Driver Name
- PUA - Sysinternal Tool Execution - Registry
- PUA - Sysinternals Tools Execution - Registry
- Python Function Execution Security Warning Disabled In Excel - Registry
- RDP Sensitive Settings Changed
- RDP Sensitive Settings Changed to Zero
- RDP shadow session configuration enabled (registry)
- RedMimicry Winnti Playbook Registry Manipulation
- Register New IFiltre For Persistence
- Registry Disable System Restore
- Registry Entries For Azorult Malware
- Registry Explorer Policy Modification
- Registry Hide Function from User
- Registry Modification for OCI DLL Redirection
- Registry Modification to Hidden File Extension
- Registry Persistence Mechanisms in Recycle Bin
- Registry Persistence via Explorer Run Key
- Registry Persistence via Service in Safe Mode
- Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
- Registry Tampering by Potentially Suspicious Processes
- RestrictedAdminMode Registry Value Tampering
- Run Once Task Configuration in Registry
- Running Chrome VPN Extensions via the Registry 2 VPN Extension
- Scheduled Task Created - Registry
- Scheduled TaskCache Change by Uncommon Program
- ScreenSaver Registry Key Set
- Scripted Diagnostics Turn Off Check Enabled - Registry
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set
- Security Support Provider (SSP) Added to LSA Configuration
- Service Binary in Suspicious Folder
- Service Binary in User Controlled Folder
- ServiceDll Hijack
- Session Manager Autorun Keys Modification
- Shell Context Menu Command Tampering
- Shell Open Registry Keys Manipulation
- Small Sieve Malware Registry Persistence
- SNAKE Malware Covert Store Registry Key
- Stickey key IFEO registry changed (Reg via Sysmon)
- Sticky Key Like Backdoor Usage - Registry
- Suspicious Application Allowed Through Exploit Guard
- Suspicious Camera and Microphone Access
- Suspicious Environment Variable Has Been Registered
- Suspicious Execution Of Renamed Sysinternals Tools - Registry
- Suspicious Keyboard Layout Load
- Suspicious Path In Keyboard Layout IME File Registry Value
- Suspicious PowerShell In Registry Run Keys
- Suspicious Printer Driver Empty Manufacturer
- Suspicious Run Key from Download
- Suspicious Service Installed
- Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
- Suspicious Shell Open Command Registry Modification
- Suspicious Shim Database Patching Activity
- Suspicious SIP or trust provider registration
- Suspicious Space Characters in RunMRU Registry Path - ClickFix
- Suspicious Space Characters in TypedPaths Registry Path - FileFix
- Sysmon Driver Altitude Change
- System crash behavior manipulation - WMImplant (registry)
- System Scripts Autorun Keys Modification
- Tamper With Sophos AV Registry Keys
- Trust Access Disable For VBApplications
- UAC Bypass Abusing Winsat Path Parsing - Registry
- UAC Bypass Using Windows Media Player - Registry
- UAC Bypass via Event Viewer
- UAC Bypass via Sdclt
- UAC Bypass Via Wsreset
- UAC Disabled
- UAC Notification Disabled
- UAC Secure Desktop Prompt Disabled
- Uncommon Extension In Keyboard Layout IME File Registry Value
- Uncommon Microsoft Office Trusted Location Added
- Usage of Renamed Sysinternals Tools - RegistrySet
- VBScript Payload Stored in Registry
- Wdigest authentication enabled (registry)
- Wdigest CredGuard Registry Modification
- Wdigest Enable UseLogonCredential
- WFP Filter Added via Registry
- Windows Credential Editor Registry
- Windows Credential Guard Disabled - Registry
- Windows Defender Exclusions Added - Registry
- Windows Defender Service Disabled - Registry
- Windows Defender Threat Severity Default Action Modified
- Windows Event Log Access Tampering Via Registry
- Windows Hypervisor Enforced Code Integrity Disabled
- Windows Recall Feature Enabled - Registry
- Windows Registry Trust Record Modification
- Windows Vulnerable Driver Blocklist Disabled
- WINEKEY Registry Modification
- Winget Admin Settings Modification
- Winlogon AllowMultipleTSSessions Enable
- Winlogon Notify Key Logon Persistence
- WinSock2 Autorun Keys Modification
- Wow6432Node Classes Autorun Keys Modification
- Wow6432Node CurrentVersion Autorun Keys Modification
- Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Elastic (60)
- Code Signing Policy Modification Through Registry
- Component Object Model Hijacking
- Creation of a Hidden Local User Account
- Creation or Modification of Root Certificate
- Deprecated - Encoded Executable Stored in the Registry
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- First Time Seen Removable Device
- Full User-Mode Dumps Enabled System-Wide
- Image File Execution Options Injection
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Local Account TokenFilter Policy Disabled
- Microsoft Windows Defender Tampering
- Modification of AmsiEnable Registry Key
- Modification of WDigest Security Provider
- MS Office Macro Security Registry Modifications
- Netsh Helper DLL
- Network Logon Provider Registry Modification
- Network-Level Authentication (NLA) Disabled
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- Outlook Home Page Registry Modification
- Persistence via a Windows Installer
- Persistence via Hidden Run Key Detected
- Persistence via WMI Standard Registry Provider
- Port Forwarding Rule Addition
- Potential LSA Authentication Package Abuse
- Potential NetNTLMv1 Downgrade Attack
- Potential Persistence via Time Provider Modification
- Potential Port Monitor or Print Processor Registration Abuse
- Potential Privilege Escalation via Service ImagePath Modification
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential RemoteMonologue Attack
- Potential SharpRDP Behavior
- PowerShell Script Block Logging Disabled
- Privilege Escalation via Windir Environment Variable
- RDP Enabled via Registry
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Scheduled Task Creation
- Scheduled Task Created by a Windows Script
- Scheduled Tasks AT Command Enabled
- Service Disabled via Registry Modification
- Service Path Modification
- SIP Provider Modification
- SolarWinds Process Disabling Services via Registry
- Startup or Run Key Registry Modification
- Suspicious ImagePath Service Creation
- Suspicious Print Spooler Point and Print DLL
- Suspicious Startup Shell Folder Modification
- Uncommon Registry Persistence Change
- Unusual Persistence via Services Registry
- Werfault ReflectDebugger Persistence
- Windows Defender Disabled via Registry Modification
- Windows Installer with Suspicious Properties
- Windows Subsystem for Linux Distribution Installed
Splunk (194)
- Active Setup Registry Autostart
- Add DefaultUser And Password In Registry
- Add DLL_EXE Registry Value (Sysmon)
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Operation with Consent Admin
- Auto Admin Logon Registry Entry
- Command Line Utility Added to Accessibility Features (Sysmon)
- ComputerDefaults UAC Bypass (Sysmon)
- ConsentPromptBehaviorAdmin Registry Value Modified (Sysmon)
- Defender Registry Values Modified (Sysmon)
- Detect Remote Access Software Usage Registry
- Disable AMSI Through Registry
- Disable Defender AntiVirus Registry
- Disable Defender BlockAtFirstSeen Feature
- Disable Defender Enhanced Notification
- Disable Defender MpEngine Registry
- Disable Defender Spynet Reporting
- Disable Defender Submit Samples Consent Feature
- Disable ETW Through Registry
- Disable Registry Tool
- Disable Security Logs Using MiniNt Registry
- Disable Show Hidden Files
- Disable UAC Remote Restriction
- Disable Windows App Hotkeys
- Disable Windows Behavior Monitoring
- Disable Windows SmartScreen Protection
- Disabling CMD Application
- Disabling ControlPanel
- Disabling Defender Services
- Disabling FolderOptions Windows Feature
- Disabling NoRun Windows App
- Disabling Remote User Account Control
- Disabling SystemRestore In Registry
- Disabling Task Manager
- Disabling Windows Local Security Authority Defences via Registry
- Enable RDP In Other Port Number
- Enable WDigest UseLogonCredential Registry
- EnableLUA Registry Value Modified (Sysmon)
- ETW Registry Disabled
- Eventvwr UAC Bypass
- Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Sysmon)
- Hidden User Created - Windows (Sysmon)
- Hide User Account From Sign-In Screen
- LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon)
- Logon Script Event Trigger Execution
- Logon Script Registry Key added (Sysmon)
- LSA Authentication Packages Registry Key Modified (Sysmon)
- Malicious InProcServer32 Modification
- Modification Of Wallpaper
- Monitor Registry Keys for Print Monitors
- NET Profiler UAC bypass
- Potential fodhelper UAC Bypass Attempt (Sysmon)
- Print Processor Registry Autostart
- PromptOnSecureDesktop Registry Value Modified (Sysmon)
- Registry Keys for Creating SHIM Databases
- Registry Keys Used For Persistence
- Registry Keys Used For Privilege Escalation
- Remcos client registry install entry
- Revil Registry Entry
- Screensaver Event Trigger Execution
- Sdclt UAC Bypass
- Set Default PowerShell Execution Policy To Unrestricted or Bypass
- SilentCleanup UAC Bypass
- Startup Folder Location Modified - Windows (Sysmon)
- Suspicious InprocServer32 Registry Modification (Sysmon)
- Time Provider Persistence Registry
- WDigest Forced Credential Caching (Sysmon)
- Windows AD DSRM Account Changes
- Windows Anomalous Registry Value Length in Environment Key
- Windows Audit Policy Auditing Option Modified - Registry
- Windows Autostart Execution LSASS Driver Registry Modification
- Windows Chrome Auto-Update Disabled via Registry
- Windows Chrome Extension Allowed Registry Modification
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Defender Disabled Detection (Sysmon)
- Windows Defender Exclusion Registry Entry
- Windows Disable Change Password Through Registry
- Windows Disable Lock Workstation Feature Through Registry
- Windows Disable LogOff Button Through Registry
- Windows Disable Memory Crash Dump
- Windows Disable Notification Center
- Windows Disable Shutdown Button Through Registry
- Windows Disable Windows Group Policy Features Through Registry
- Windows DisableAntiSpyware Registry
- Windows Downdate Registry Activity
- Windows Enable Win32 ScheduledJob via Registry
- Windows Filtering Platform Policy Added to Block EDR Process
- Windows Hide Notification Features Through Registry
- Windows Impair Defense Change Win Defender Health Check Intervals
- Windows Impair Defense Change Win Defender Quick Scan Interval
- Windows Impair Defense Change Win Defender Throttle Rate
- Windows Impair Defense Change Win Defender Tracing Level
- Windows Impair Defense Configure App Install Control
- Windows Impair Defense Define Win Defender Threat Action
- Windows Impair Defense Delete Win Defender Context Menu
- Windows Impair Defense Delete Win Defender Profile Registry
- Windows Impair Defense Deny Security Software With Applocker
- Windows Impair Defense Disable Controlled Folder Access
- Windows Impair Defense Disable Defender Firewall And Network
- Windows Impair Defense Disable Defender Protocol Recognition
- Windows Impair Defense Disable PUA Protection
- Windows Impair Defense Disable Realtime Signature Delivery
- Windows Impair Defense Disable Web Evaluation
- Windows Impair Defense Disable Win Defender App Guard
- Windows Impair Defense Disable Win Defender Compute File Hashes
- Windows Impair Defense Disable Win Defender Gen reports
- Windows Impair Defense Disable Win Defender Network Protection
- Windows Impair Defense Disable Win Defender Report Infection
- Windows Impair Defense Disable Win Defender Scan On Update
- Windows Impair Defense Disable Win Defender Signature Retirement
- Windows Impair Defense Overide Win Defender Phishing Filter
- Windows Impair Defense Override SmartScreen Prompt
- Windows Impair Defense Set Win Defender Smart Screen Level To Warn
- Windows Impair Defenses Disable Auto Logger Session
- Windows Impair Defenses Disable AV AutoStart via Registry
- Windows Impair Defenses Disable HVCI
- Windows Impair Defenses Disable Win Defender Auto Logging
- Windows InProcServer32 New Outlook Form
- Windows LSA Secrets NoLMhash Registry
- Windows Modify Registry AuthenticationLevelOverride
- Windows Modify Registry Auto Minor Updates
- Windows Modify Registry Auto Update Notif
- Windows Modify Registry Configure BitLocker
- Windows Modify Registry Default Icon Setting
- Windows Modify Registry Disable RDP
- Windows Modify Registry Disable Restricted Admin
- Windows Modify Registry Disable Toast Notifications
- Windows Modify Registry Disable Win Defender Raw Write Notif
- Windows Modify Registry Disable WinDefender Notifications
- Windows Modify Registry Disable Windows Security Center Notif
- Windows Modify Registry DisableRemoteDesktopAntiAlias
- Windows Modify Registry DisableSecuritySettings
- Windows Modify Registry Disabling WER Settings
- Windows Modify Registry DisAllow Windows App
- Windows Modify Registry Do Not Connect To Win Update
- Windows Modify Registry DontShowUI
- Windows Modify Registry EnableLinkedConnections
- Windows Modify Registry LongPathsEnabled
- Windows Modify Registry MaxConnectionPerServer
- Windows Modify Registry No Auto Reboot With Logon User
- Windows Modify Registry No Auto Update
- Windows Modify Registry NoChangingWallPaper
- Windows Modify Registry on Smart Card Group Policy
- Windows Modify Registry ProxyEnable
- Windows Modify Registry ProxyServer
- Windows Modify Registry Qakbot Binary Data Registry
- Windows Modify Registry Suppress Win Defender Notif
- Windows Modify Registry Tamper Protection
- Windows Modify Registry to Add or Modify Firewall Rule
- Windows Modify Registry UpdateServiceUrlAlternate
- Windows Modify Registry USeWuServer
- Windows Modify Registry Utilize ProgIDs
- Windows Modify Registry ValleyRAT C2 Config
- Windows Modify Registry ValleyRat PWN Reg Entry
- Windows Modify Registry With MD5 Reg Key Name
- Windows Modify Registry WuServer
- Windows Modify Registry wuStatusServer
- Windows Modify Show Compress Color And Info Tip Registry
- Windows Mshta Execution In Registry
- Windows New Custom Security Descriptor Set On EventLog Channel
- Windows New Default File Association Value Set
- Windows New EventLog ChannelAccess Registry Value Set
- Windows New InProcServer32 Added
- Windows Njrat Fileless Storage via Registry
- Windows Outlook Dialogs Disabled from Unusual Process
- Windows Outlook LoadMacroProviderOnBoot Persistence
- Windows Outlook Macro Security Modified
- Windows Outlook WebView Registry Modification
- Windows Phishing Recent ISO Exec Registry
- Windows Process Executed From Removable Media
- Windows Proxy Via Registry
- Windows RDP Server Registry Deletion
- Windows RDP Server Registry Entry Created
- Windows Registry BootExecute Modification
- Windows Registry Certificate Added
- Windows Registry Dotnet ETW Disabled Via ENV Variable
- Windows Registry Modification for Safe Mode Persistence
- Windows Registry Payload Injection
- Windows Registry SIP Provider Modification
- Windows Remote Access Software RMS Registry
- Windows Remote Services Allow Remote Assistance
- Windows Remote Services Rdp Enable
- Windows Routing and Remote Access Service Registry Key Change
- Windows RunMRU Command Execution
- Windows Service Creation Using Registry Entry
- Windows Service Deletion In Registry
- Windows Set Network Profile Category to Private via Registry
- Windows Snake Malware Registry Modification wav OpenWithProgIds
- Windows SnappyBee Create Test Registry
- Windows USBSTOR Registry Key Modification
- Windows WPDBusEnum Registry Key Modification
- WinLogon Registry Key Modified (Sysmon)
- Wow6432Node Classes Autorun Keys Modification (Sysmon)
- WSReset UAC Bypass
Kusto (15)
- COM Registry Key Modified to Point to File in Color Profile Folder
- Component Object Model Hijacking - Vault7 trick
- Detect Print Processors Registry Driver Key Creation/Modification
- Detect Registry Run Key Creation/Modification
- Detect Windows Allow Firewall Rule Addition/Modification
- Detect Windows Update Disabled from Registry
- DSRM Account Abuse
- MosaicLoader
- Potential Fodhelper UAC Bypass (ASIM Version)
- Registry Persistence via AppCert DLL Modification
- Registry Persistence via AppInit DLLs Modification
- Registry Run Keys - Suspicious Registry Run Keys
- Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint)
- Spearphishing Attachment: ISO Images (Microsoft Sentinel)
- WDigest downgrade attack
YARA-L (15)
- Blackbyte Ransomware Registry
- CurrentControlSet Autorun Keys Modification
- CurrentVersion Autorun Keys Modification
- Default RDP Port Changed to Non Standard Port
- Disable Internal Tools or Feature in Registry
- MITRE ATT&CK T1090 Port Proxy Forwarding CISA Report
- Modify User Shell Folders Startup Value
- New RUN Key Pointing to Suspicious Folder
- Potential Credential Dumping Via LSASS SilentProcessExit Technique
- RDP Sensitive Settings Changed
- RDP Sensitive Settings Changed to Zero
- RestrictedAdminMode Registry Value Tampering
- Session Manager Autorun Keys Modification
- Suspicious Powershell In Registry Run Keys
- Wdigest Enable UseLogonCredential