Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects evidence of the PIVOTPIPE .NET loader attempting to disable AMSI scanning. The detection focuses on activity related to patching the 'AmsiScanBuffer' function within 'amsi.dll', specifically identifying the use of the hex signature '80070057' or direct references to the function name, which is an indicator of an AMSI bypass attempt performed to facilitate malicious code execution.
Detects the presence of the known vulnerable DCRCVDrv.sys kernel driver, which has been identified as being abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security processes via unauthorized IOCTL calls to ZwTerminateProcess.
Detects instances where processes (excluding known legitimate .NET processes) load common .NET runtime modules (e.g., clr.dll, mscoree.dll) followed by remote process injection or handle-based process access, which is often indicative of reflective assembly loading used by loaders like PIVOTPIPE to execute malicious code within a target process.
Detects active attempts to disable or interfere with security products, including EDR agents and antivirus software. The rule monitors for the use of 'sc.exe' to stop or reconfigure services, 'taskkill' to terminate security-related processes, and PowerShell commands utilizing 'Set-MpPreference' to modify Windows Defender real-time protection settings. These actions are frequently observed as a precursor to ransomware deployment or other malicious activities designed to evade detection.
This rule detects potentially malicious in-memory activity within the 'GRrte.exe' process, specifically targeting behaviors associated with PlugX malware. It monitors for suspicious memory protection changes (e.g., requests for Read-Write-Execute permissions) and the loading of the 'ws2_32.dll' library, which is commonly used to facilitate network communication in side-loaded payloads.
Detects instances where the process 'GRrte.exe' forcefully terminates 'iediagcmd.exe' using taskkill.exe. This activity is indicative of an attempt to disable or impair specific security diagnostic tools or EDR-related components on the host.
Detects the use of the Android Package Manager (pm) utility via ADB to either disable or uninstall packages for the system user (user 0). This activity is often used by adversaries to remove security applications, anti-malware, or logging utilities from an Android device.
Detects process injection and hook evasion attempts where a thread is created or modified with a start address that does not resolve to a known, legitimate memory module. This pattern is indicative of shellcode execution or reflective DLL injection where the malicious code resides in anonymous or unbacked memory regions.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects instances of process injection targeting the 'attrib.exe' process. This behavior is associated with the Sauron Loader, which performs in-memory shellcode execution by allocating memory and creating a remote thread within a legitimate process, such as 'attrib.exe', to avoid writing payloads to disk.
This rule detects a multi-stage attack pattern consistent with a Bring Your Own Vulnerable Driver (BYOVD) chain. It identifies the installation of specific known vulnerable drivers (e.g., Alinubx.sys, nvfsflt64.sys) and the registration of a corresponding service (NvFsFilter), followed by the mass termination of various security software and EDR processes within a short timeframe. This behavior is indicative of an adversary using kernel-mode privileges to disable security controls.
Detects instances where PowerShell is executed with an explorer.exe parent process, but the actual creating process differs from explorer.exe. This behavior is indicative of parent PID (PPID) spoofing, a technique often used to evade detection or masquerade the execution source by abusing the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS flag in the Windows API.
Detects command-line activity indicating an attempt to bypass or tamper with Anti-Malware Scan Interface (AMSI) functionality. The rule flags processes invoking GetProcAddress or LoadLibrary to resolve and manipulate AMSI-specific functions like AmsiScanBuffer or AmsiScanString within amsi.dll, a common technique for disabling runtime script scanning.
Detects attempts to patch or disable Event Tracing for Windows (ETW) functionality by identifying memory modification operations targeting the 'EtwEventWrite' function or direct memory protection changes within 'ntdll.dll'. This is a common technique used by malware and post-exploitation tools to blind security telemetry.
Detects unexpected crashes or restarts of the Windows Defender service (MsMpEng.exe) occurring in temporal proximity to activities associated with the ShieldCrash PoC or tampering within the Windows Defender object manager namespace. This rule aims to identify potential exploitation attempts targeting Windows Defender, specifically correlating security service instability with known malicious indicators.
This rule detects attempts by a process (specifically targeting PowerShell or .NET loaders) to tamper with Windows Antimalware Scan Interface (AMSI) components in memory. It correlates EDR or Sysmon events (process access, module loads) targeting 'amsi.dll' or involving specific AMSI API strings like 'AmsiScanBuffer' or 'AmsiInitFailed' with potential malicious loader activity.
Detects attempts to disable Windows Defender Tamper Protection via direct Registry modification or by executing PowerShell commands. Disabling Tamper Protection is a common tactic used by adversaries to facilitate further malicious activity, such as impairing security controls or deleting malware artifacts without interference from Windows Defender.
This rule detects unauthorized memory modification of ntdll.dll, specifically targeting the EtwEventWrite function, by identifying processes writing to memory regions with execution-permission flags (e.g., PAGE_EXECUTE_READWRITE). This behavior is characteristic of adversaries attempting to blind Event Tracing for Windows (ETW) telemetry, often following suspicious .NET assembly loading (such as Assembly.Load) typical of malware loaders like LausivLoader.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
The following analytic detects duplicate-handle access to known UAC-bypass binaries from a non-standard source path.
It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE.
It leverages Sysmon EventCode 10, converts GrantedAccess from hexadecimal, and checks for PROCESS_DUP_HANDLE.
Page 10 of 52