Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI). This rule monitors for command-line arguments indicative of reflection-based patching of AmsiUtils and forced AmsiScanBuffer failures, as well as registry modifications to AMSI providers.
Detects the use of the 'Add-MpPreference' PowerShell cmdlet with the '-ExclusionPath' parameter, which is used to add file, folder, or extension exclusions to Microsoft Defender. Attackers frequently use this technique to prevent security software from scanning or detecting malicious files or directories.
This rule detects processes manually resolving API function addresses by traversing the Process Environment Block (PEB) Ldr structure or parsing module export tables. This technique is often used by malicious code to resolve Windows API functions dynamically without relying on standard LoadLibrary or GetProcAddress calls, effectively evading common API-hooking based monitoring.
This rule detects the use of the 'Add-MpPreference' PowerShell cmdlet with the '-ExclusionPath' argument to add specific file or directory paths to Microsoft Defender's exclusion list. This behavior is a common technique used by adversaries to bypass security controls by ensuring malicious tools or scripts are not scanned by Windows Defender. The rule specifically alerts on exclusions related to common staging areas or specific tools such as Telegram Desktop, SSH cache folders, and package management directories.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
Detects suspicious process injection attempts into browser processes (e.g., chrome.exe, msedge.exe) characterized by direct NT API syscall invocation (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) originating from a non-browser parent process. This behavior, often associated with the Remus infostealer, bypasses standard user-mode API hooking by using direct syscall stubs to chain injection actions.
Detects suspicious process injection attempts into browser processes (e.g., chrome.exe, msedge.exe) characterized by direct NT API syscall invocation (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) originating from a non-browser parent process. This behavior, often associated with the Remus infostealer, bypasses standard user-mode API hooking by using direct syscall stubs to chain injection actions.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
This rule detects the execution, file presence, or driver loading associated with 'EDRKiller' and 'WarsawKiller', which are malicious tools used to terminate or disable endpoint security products.
This rule detects attempts to patch critical Windows functions used for security instrumentation, specifically 'AmsiScanBuffer' within 'amsi.dll' (often for bypassing AMSI) or 'EtwEventWrite' within 'ntdll.dll' (often for disabling ETW logging). This activity is highly indicative of defensive evasion techniques used by malware or malicious actors to hide their behavior from security tools.
Detects memory regions associated with 'ntdll.dll' that are marked with Read, Write, and Execute (RWX) permissions. This pattern is commonly used in process injection techniques, such as reflective DLL injection or shellcode execution, where adversaries prepare executable memory space within a legitimate process to bypass standard security controls.
Detects unauthorized in-memory memory modifications (specifically writing to memory segments with execute permissions) targeting critical security functions within 'amsi.dll' or 'ntdll.dll', such as 'AmsiScanBuffer' or 'EtwEventWrite'. This activity is characteristic of AMSI/ETW blinding, a technique used by threat actors to disable endpoint security scanning and event tracing capabilities.
Detects the CRPx0 ransomware technique of unhooking ntdll.dll in memory. This is achieved by reading the ntdll.dll file from disk and overwriting the in-memory .text section with a clean, unhooked version to bypass EDR monitoring and execute direct syscalls.
Detects the modification of boot configuration data (BCD) using bcdedit to enable 'Safe Mode with Networking' on the next reboot. Adversaries, including Akira ransomware affiliates, use this technique to bypass endpoint detection and response (EDR) solutions by ensuring they do not start when the system boots in a restricted safe mode.
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
Detects the use of bcdedit.exe to modify boot configuration data to enable Safe Mode with Networking. This technique is used by Akira ransomware affiliates to potentially disable or impair EDR and other security tooling prior to deploying the ransomware payload.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Page 13 of 52