Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
268 detections
Filters
Last updated
All Time
Detection languages
166
53
14
9
9
Contributors
57
40
38
37
29
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
253
15
11
5
5
Products / Services
160
108
35
14
14
MITRE Techniques
116
85
80
53
41
CVEs
6
2
1
1
1
IDS Classtypes
3
IDS Protocols
2
Detects when Windows Defender Real-time Protection is disabled. This event may not contain detailed information about the initiator, requiring further investigation.
This rule detects relevant ClamAV messages indicating the presence of various types of malware. It specifically looks for keywords like 'Trojan*FOUND', 'VirTool*FOUND', 'Webshell*FOUND', 'Rootkit*FOUND', and 'Htran*FOUND' in ClamAV logs. These keywords suggest that ClamAV has identified and reported a malicious file or component.
This rule detects blocked attempts to modify Microsoft Defender Antivirus settings when Tamper Protection is enabled. Specifically, it looks for Event ID 5013 from the Windows Defender service, which indicates that Tamper Protection has blocked a change to Defender's configuration. The rule targets attempts to disable key features such as AntiSpyware, AntiVirus, archive scanning, network file scanning, real-time monitoring, behavior monitoring, IOAV protection, and script scanning by monitoring specific registry value paths.
This rule detects when a file is restored from quarantine by Microsoft Defender Antivirus. This action is logged with Event ID 1009 in the Microsoft-Windows-Windows Defender/Operational event log. While legitimate administrators might restore files, this event can also indicate an adversary attempting to reintroduce malicious files that were previously quarantined, potentially as part of a defense evasion strategy.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe) as indicated by an Application Error event (EventID 1000) containing both 'MsMpEng.exe' and 'mpengine.dll' in the event data. Such crashes could be indicative of an attempt to bypass or disable antivirus defenses, potentially through exploitation of vulnerabilities in the engine.
This rule detects events indicating issues with Windows Defender Real-Time Protection features. Specifically, it triggers when Real-Time Protection encounters an error and fails (EventID 3002) or when a Real-Time Protection feature restarts (EventID 3007). It filters out common false positives related to Network Inspection System errors due to missing updates or unknown antimalware security intelligence issues.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe), specifically when the mpengine.dll module is involved. Such crashes can indicate an attempt to exploit vulnerabilities in the antivirus software to bypass security defenses or disable the tool. The detection relies on Windows Error Reporting (EventID 1001) logs containing specific process and module names.
Detects suspicious changes to Windows Defender's configuration settings, which could indicate an attempt to disable or impair its protective capabilities. This rule specifically looks for modifications to registry keys related to disabling anti-spyware, removable drive scanning, network drive scanning, cloud-delivered protection (Block at First Seen), and real-time protection reporting.
Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.
Detects actions taken by Windows Defender malware detection engines, indicating that malware or potentially unwanted software has been found, suspicious behavior has been detected, or an action has been performed to protect the system.
Detects when the grace period for Windows Defender expires, indicating that protection against viruses, spyware, and other potentially unwanted software is disabled. This event suggests a critical security control has been impaired.
This rule detects when Windows Defender logs the deletion of its malware detection history. This action can be performed by an attacker to remove traces of their activity or to prevent the system from reporting previously detected malware.
Detects when the Windows Defender feature for scanning malware and potentially unwanted software is disabled. This is indicated by Event ID 5010 from the WinDefend service.
Detects when the Windows Defender antivirus scanning feature is disabled, indicated by Event ID 5012 from the WinDefend service. This action is often performed by adversaries to impair defenses and avoid detection.
Detects triggering of AMSI by Windows Defender.
Detects relevant ClamAV messages
Page 13 of 13