Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
247
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
210
138
110
82
78
Products / Services
147
74
62
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Page 25 of 25