Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects suspicious PowerShell activity characteristic of the ScreenConnect AsyncRAT campaign, specifically the use of Add-MpPreference to add Windows Defender exclusions for RegAsm.exe and drive roots, and the modification of ConsentPromptBehaviorAdmin to suppress UAC prompts. These actions facilitate process hollowing and malware execution with elevated privileges.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects the use of the Microsoft IIS administrative tool, appcmd.exe, to uninstall ModSecurity WAF modules. This activity is a known technique used by adversaries to impair security defenses during post-exploitation, specifically observed in campaigns targeting ColdFusion servers.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, including real-time monitoring, behavior monitoring, and antispyware features, or attempts to stop/disable the WinDefend service.
Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.
Detects evidence of PPID spoofing associated with the StrikeShark/Cobalt Strike framework. The detection identifies suspicious child processes (e.g., cmd.exe, powershell.exe) originating from common system processes (e.g., explorer.exe, svchost.exe) while the actual ancestor is a malicious SystemSettings.exe binary located in non-standard AppData paths. It correlates these process events with account mismatches between the spoofed parent and child process, indicating CreateProcessWithTokenW usage for token impersonation.
Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.
Detects modifications to Windows Defender registry keys responsible for defining file, path, process, or extension exclusions. Adversaries often modify these settings to prevent security software from scanning their malicious artifacts.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Fraud framework powering scam domains for crypto and gambling schemes
Ransomware group exploiting edge devices and managed file transfer software
Detects the loading of amsi.dll by processes running from suspicious or user-writable directories (e.g., Temp, AppData) or common scripting interpreters like Python. This behavior is often indicative of an attempt to tamper with or bypass the Antimalware Scan Interface (AMSI) for malicious purposes.
Detects memory patching operations targeting 'ntdll.dll', specifically aiming to disable ETW (Event Tracing for Windows) by modifying 'EtwEventWrite' or 'NtTraceEvent' functions. This activity is filtered to detect processes originating from PyInstaller-compiled binaries, identified by the use of '_MEI' temporary extraction directories or specific process names like 'winupdate.exe', which are commonly associated with malicious use of the PyInstaller framework.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
Page 33 of 52