Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects evidence of the BeepRAT malware (via known file names, loader behavior, and specific command-line arguments) and attempts to tamper with security software through process termination, service modification, or the addition of Windows Defender exclusions.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
Detects anomalous process creation where svchost.exe or explorer.exe is spawned by a process other than standard system parents (e.g., services.exe, wininit.exe). This behavior is consistent with SystemBC (Coroxy) reflective DLL loading or process hollowing, where malicious code is injected into core Windows processes to evade detection.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
This rule detects potentially malicious activity involving the CredentialUIBroker.exe process or the use of SetWindowsHookEx API calls. These behaviors are often associated with attempts to intercept user input or dump credentials from system processes.
Detects the loading of known hooking libraries (MinHook or Microsoft Detours) or SharkLoader-specific components (SyncRes.dat) into non-system processes, followed by the staging of payload components in user directories. This behavior is indicative of malware attempting to intercept critical system APIs (such as VirtualAlloc and Sleep) to evade memory scanning and analysis by EDR solutions.
Detects the modification of Image File Execution Options (IFEO) registry keys to assign a debugger to critical Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique is a common method for achieving persistence or privilege escalation by executing arbitrary code when these accessibility features are triggered, often at the Windows login screen.
This rule detects processes that load 'amsi.dll' followed by a call to 'VirtualProtectApiCall' with 'PAGE_EXECUTE_READWRITE' memory protection flags within a 30-second window. This behavioral pattern is frequently used in fileless execution techniques to disable Antimalware Scan Interface (AMSI) or to facilitate the execution of shellcode by modifying memory permissions.
Detects behavior indicative of the SNOWLIGHT dropper, which uses direct syscalls to perform memory allocation (VirtualAlloc/VirtualProtect with PAGE_EXECUTE_READWRITE) and subsequent process access to LSASS or other critical security processes (MsMpEng.exe, csrss.exe, winlogon.exe). The detection specifically looks for the absence of ntdll.dll in the call stack during these operations, signaling an EDR bypass attempt via direct syscalls within a 60-second window.
This rule detects a sequence of Windows API calls indicative of process injection behavior associated with the VSHELL RAT (UNC5221). The detection monitors for the combination of VirtualAllocEx (with page permissions allowing execution), WriteProcessMemory, and QueueUserAPC or NtQueueApcThread targeting common Windows system processes (svchost.exe, explorer.exe, notepad.exe) from the same source process within a one-minute window.
Detects the modification of the 'Debugger' registry value for 'agntsvc.exe' under the Image File Execution Options (IFEO) registry key. This technique is often used by adversaries for persistence or to intercept and manipulate process execution by forcing a specified program (in this case, 'Systray.exe') to run when 'agntsvc.exe' starts.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
Detects reflective process injection attempts where a suspicious executable, masquerading as 'Mixed Reality.exe' in a Windows Media Player directory, attempts to inject code into the svchost.exe system process using cross-process memory operations like CreateRemoteThread.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
This rule detects suspicious PowerShell script behavior that attempts to patch the Anti-Malware Scan Interface (AMSI) in-memory by manipulating internal .NET/CLR methods. It identifies the combination of dangerous API calls (e.g., VirtualProtect, Marshal.Copy, PrepareMethod) typically used to bypass AMSI scanning via JIT compilation patching targeting the WinScanContent method.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
This rule detects potential attempts to disable Anti-Malware Scan Interface (AMSI) in PowerShell 5.1 using reflection-based manipulation of the amsiInitFailed boolean field in the System.Management.Automation.AmsiUtils class. Attackers often use obfuscation techniques such as splitting strings or using reflection methods to bypass static security signatures.
This rule detects potential malicious activity involving PowerShell by correlating signs of an Antimalware Scan Interface (AMSI) bypass attempt with an subsequent network connection to an external, non-standard port. The rule monitors for common command-line patterns used to disable or impair AMSI functionality within PowerShell processes, followed by suspicious outbound network traffic from the same process within a five-minute window.
Page 37 of 52