Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
268 detections
Filters
Last updated
All Time
Detection languages
166
53
14
9
9
Contributors
57
40
38
37
29
Categories
20,407
11,798
5,867
5,145
4,864
Platforms
253
15
11
5
5
Products / Services
160
108
35
14
14
MITRE Techniques
116
85
80
53
41
CVEs
6
2
1
1
1
IDS Classtypes
3
IDS Protocols
2
Detects malicious script execution triggered by the CVE-2026-42897 XSS vulnerability in Outlook Web Access (OWA). The detection rule monitors AMSI script detection events for patterns associated with the OWAReaper exploit chain, which utilizes an 'onload=eval(atob())' loader to reconstruct a base64-encoded payload embedded in social-icon image tags within a browser session.
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
Detects when the Tamper Protection feature of Windows Defender is disabled. This action is often taken by adversaries or malicious software to weaken endpoint defenses and facilitate further compromise or concealment of malicious activity.
Detects modifications to Windows Defender exclusion settings by monitoring both PowerShell command lines containing 'Set-MpPreference' with 'ExclusionPath' and direct Registry modifications to the Defender exclusions key. Threat actors commonly use these techniques to bypass security scanning for malicious files or tools placed in the 'C:\ProgramData' directory.
Detects unauthorized attempts to modify Microsoft Defender Tamper Protection registry keys. The rule correlates registry value changes from '5' (Enabled) to '0' or '4' (Disabled) against Microsoft Defender Antivirus Troubleshooting Mode events to distinguish between legitimate administrative troubleshooting and potentially suspicious local tampering.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
Detects the creation of an NTFS Alternate Data Stream named :WDFOO in temporary staging directories, often associated with wermgr.exe and subsequent Windows Defender scans. This behavior is indicative of a TOCTOU (Time-of-Check Time-of-Use) exploitation chain, specifically linked to the RoguePlanet exploit targeting CVE-2026-50656, where EICAR test strings are used to manipulate anti-virus detection flows.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects anomalous file creation or modification events in sensitive Windows System32 directories originating from the Microsoft Defender process (MsMpEng.exe). Additionally, it detects when MsMpEng.exe spawns interactive shells (e.g., cmd.exe, powershell.exe), which is indicative of potential exploitation of vulnerabilities such as CVE-2026-33825, where attacker-controlled file operations are redirected via junction points.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Page 6 of 13