Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects instances where a process attempts to change memory permissions (using VirtualProtect) on sensitive security-related modules 'amsi.dll' or 'ntdll.dll'. This is a common technique used by shellcode loaders and malware to disable Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) by patching their respective scan functions in memory.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
Detects the sequence of API calls and process state changes indicative of process hollowing targeting a suspended svchost.exe process. The rule monitors for the creation of a suspended svchost.exe process followed by memory operations such as unmapping, allocating, and writing to the target process memory, culminating in thread context modification and resumption, a behavior consistent with malicious process injection techniques.
Detects the creation or modification of Registry keys and values associated with Image File Execution Options (IFEO). Adversaries commonly abuse IFEO for persistence, privilege escalation, or to hijack process execution by attaching malicious debuggers to legitimate system binaries, such as MsMpEng.exe, or by creating temp hive mounts.
This rule detects potentially malicious activity involving the ServiceModelReg.exe process, a known vector for ResiLoader process hollowing. It monitors for cross-process injection (e.g., process hollowing) and process creation events where ServiceModelReg.exe is spawned by suspicious parent processes (such as scripting engines) or originates from an unexpected location.
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
This rule monitors for the execution of known software utilities often used by adversaries to disable security controls, remove system locks on files, or tamper with security configurations. Specifically, it flags the usage of IObit Unlocker, Gmer (a known rootkit/tampering tool), and Defender Control (used to disable Windows Defender).
This rule detects processes that perform both memory allocation (VirtualAlloc) and cryptographic random number generation (BCryptGenRandom) within a short timeframe. This combination is highly characteristic of reflective loading or stage-based process injection, where an adversary allocates memory for shellcode and generates keys or seeds for encrypted payloads, often used to evade signature-based detection.
Detects modifications to the Image File Execution Options (IFEO) registry keys for critical Windows accessibility binaries such as osk.exe, utilman.exe, sethc.exe, magnify.exe, and narrator.exe. This technique is commonly used by adversaries to establish persistence or facilitate unauthenticated privilege escalation by replacing these tools with malicious executables (e.g., cmd.exe) that execute when triggered from the Windows login screen.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
Detects the manual or malicious termination of security-related processes, including antivirus software, endpoint protection agents, and diagnostic/monitoring tools (e.g., Task Manager, Process Explorer, Wireshark). Such behavior is often indicative of an adversary attempting to impair security defenses to facilitate further malicious activity.
Detects attempts to disable or tamper with Microsoft Defender by terminating its processes, stopping its associated services, adding directory exclusions, or modifying registry keys used to control its behavior and security settings.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects the loading of the known vulnerable OPSWAT AppRemover driver (pcdhost.sys). This driver is often abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks, such as those performed by ResiLoader, to execute code in kernel mode and bypass security controls, ultimately allowing the termination of protected security processes.
This rule detects potential malicious process injection originating from web browsers (chrome.exe or msedge.exe) when followed by the creation or access of a hex-named text file in the C:\ProgramData directory within a 5-minute window. This behavior often suggests a staged attack where a browser process is used to inject malicious code, and subsequently reads or interacts with a dropped file used for persistence or command-and-control communication.
Detects the use of reg.exe to modify Windows Registry keys related to disabling or tampering with Windows Defender security settings, such as Real-time Monitoring, Tamper Protection, and various scanning features.
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
Detects the modification of the 'ServiceDLL' Registry value for a Windows service to a path that resides outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. This behavior is often associated with service hijacking or persistence techniques where an adversary points a service to a malicious DLL for execution.
Detects various methods of disabling or tampering with Windows Defender protections, including modifying preferences via PowerShell (Set-MpPreference), stopping the WinDefend service via sc.exe, terminating the antivirus process via taskkill, or modifying Registry keys associated with Defender policies.
Detects instances where a process opens ntdll.dll directly from the filesystem as a file object. This behavior is indicative of an EDR unhooking technique where an adversary reads a clean, original version of ntdll.dll from disk to overwrite EDR-injected hook bytes in memory, thereby bypassing user-mode monitoring.
Detects process hollowing behavior where a ClickFix-delivered loader payload targets legitimate Windows host processes like explorer.exe or svchost.exe. The detection looks for a combination of memory operations (NtUnmapViewOfSection, WriteProcessMemory, PAGE_EXECUTE_READWRITE allocation) and thread control (SetThreadContext, ResumeThread) indicative of malicious code injection.
Page 30 of 52