Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
3
1
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
4
Products / Services
3
1
MITRE Techniques
3
2
1
1
1
Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.
Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
This rule detects attempts to tamper with Windows Defender settings using PowerShell's Set-MpPreference cmdlet. Specifically, it looks for commands that disable various Defender features like real-time monitoring, behavior monitoring, archive scanning, or set default threat actions to 'Allow'. This activity is indicative of an adversary trying to impair defensive capabilities on a system.