Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects signs of process hollowing targeting ServiceModelReg.exe, a technique used by ResiLoader to execute the StealC information stealer. The rule monitors for suspicious cross-process access (high-privilege handles), remote thread creation, and anomalous module loading patterns within the target process.
This rule monitors registry modifications targeting Windows Defender policies and Sysmon service configuration. Specifically, it tracks attempts to disable real-time protection, anti-spyware features, and service settings commonly used by adversaries to impair security monitoring and defensive tools, characteristic of defense impairment tradecraft.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.
Detects the loading of known vulnerable drivers (e.g., ProcessMonitorDriver.sys, inpoutx64.sys) associated with 'The Gentlemen' RaaS group, used in BYOVD attacks to elevate privileges and terminate security products.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, blinding EDR telemetry. This rule specifically looks for WriteProcessMemory API calls targeting ntdll.dll from processes like InstallUtil.exe, MSBuild.exe, and powershell.exe, which are commonly abused for code execution and evasion.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to locate and modify the internal 'amsiInitFailed' or 's_amsiInitFailed' fields within the AmsiUtils class. This technique prevents PowerShell from correctly identifying or blocking malicious scripts by forcing the AMSI initialization status to a state indicating a failure has already occurred, effectively disabling the security engine for that session.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
This rule detects various Windows persistence and hijacking techniques by monitoring registry activity. Specifically, it identifies the manipulation of IFEO (Image File Execution Options) Debugger or GlobalFlag keys, HKCU COM class hijacking through InProcServer32 or LocalServer32, and the AppCertDlls registry value, which can be used to inject malicious code into processes.
Detects attempts by malicious processes to disable AMSI (Antimalware Scan Interface) by memory-patching the AmsiOpenSession function. The rule monitors processes loading amsi.dll that match known loaders used by DcRAT malware, which use VirtualProtect to alter memory segments in order to bypass security scans of .NET payloads.
Detects evidence of process hollowing involving 'ServiceModelReg.exe', often used to conceal malicious stealer activity. The rule correlates the creation of this process with subsequent unexpected outbound network connections from the same process/host, and also monitors for specific debug/log strings indicative of failed or active process hollowing attempts (RUNPE techniques).
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Detects suspicious cross-process memory injection activity by correlating remote virtual memory allocation (VirtualAllocEx or MapViewOfSection) followed by the creation of a remote thread (CreateRemoteThread) targeting established legitimate Windows processes. This behavior is commonly associated with malware loaders such as Payouts King and RomulusLoader for facilitating code injection.
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
This rule detects the legitimate Windows filter manager utility, fltMC.exe, performing suspicious activities when launched from temporary directories. It specifically flags cases where fltMC.exe loads modules without a corresponding file path (indicative of reflective DLL injection) or initiates sensitive memory allocation APIs (such as VirtualAllocEx or CreateRemoteThread) that are commonly associated with process hollowing or code injection.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by executing PowerShell commands that manipulate memory structures directly. Specifically, it looks for the use of the Marshal.WriteInt64 method to nullify the pAppName pointer at offset 0x08 within the AMSI_CONTEXT_INTERNAL structure, a known technique to disable AMSI scanning for the current process.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by patching the AMSI context in memory. The rule identifies the combination of using VirtualProtect via P/Invoke to modify memory protections, followed by using Marshal.WriteInt64 to overwrite the pAppName field in the AmsiContext structure. This technique is commonly used by obfuscated PowerShell scripts to evade signature-based detection.
This rule detects modifications to critical Windows registry keys associated with disabling security features (Microsoft Defender, WDigest credential storage) or establishing persistence via Image File Execution Options (IFEO). These modifications are often performed by adversaries to impair defensive monitoring, bypass credential protections, or execute malicious code when specific processes start.
Detects the execution of commands to disable Microsoft Defender (specifically Set-MpPreference or stopping the WinDefend service) within 10 minutes of the first interactive user login on a host. This behavior is indicative of threat actors, such as Akira ransomware affiliates, performing anti-forensics and disabling security controls on newly provisioned or compromised systems.
Page 31 of 52