Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.
Detects various methods of establishing persistence on Linux systems by abusing dynamic linker configuration (/etc/ld.so.preload), modifying shell startup profiles (.bashrc, .profile) to include malicious environment variables (LD_PRELOAD/LD_LIBRARY_PATH), or directly launching processes with these hijacked variables pointing to suspicious locations such as /tmp, /dev/shm, or /var/tmp.
Detects the initialization sequence of the Millenium RAT, which attempts to weaken host security by adding the entire C:\ drive as an exclusion path for Windows Defender using the Add-MpPreference PowerShell cmdlet.
Detects potential Antimalware Scan Interface (AMSI) bypass attempts where a process loads amsi.dll followed by suspicious memory modification operations (e.g., VirtualProtect, WriteProcessMemory) targeting the AmsiOpenSession function or the amsi.dll memory space. This is a common technique used by malware like DcRAT and various loaders to neutralize endpoint security visibility.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. This is achieved by monitoring command-line arguments for keywords associated with memory patching or reflection techniques, such as modifying AmsiScanBuffer, AmsiUtils, or interacting with amsi.dll to neutralize security scanning.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. This is achieved by monitoring command-line arguments for keywords associated with memory patching or reflection techniques, such as modifying AmsiScanBuffer, AmsiUtils, or interacting with amsi.dll to neutralize security scanning.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
Detects the use of built-in Windows utilities (vssadmin, wmic, bcdedit, cipher) to delete Volume Shadow Copies or modify boot/recovery configurations, which is a common behavior used by ransomware and attackers to inhibit system recovery.
Detects evidence of BeepRAT malware performing in-memory AMSI or ETW bypass techniques via process command line arguments (e.g., AmsiUtils, AmsiScanBuffer, EtwEventWrite) originating from volatile directories like AppData or Temp, followed by the execution of suspicious processes (PowerShell, csc.exe, msbuild.exe) within a 5-minute window on the same host.
Identifies the SFX module bdzsfx.x64.sfx interacting with security providers to disrupt runtime telemetry.
This rule detects attempts to bypass AMSI (Antimalware Scan Interface) by overwriting the AmsiScanBuffer function in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events where the target address is within the memory region of 'amsi.dll', indicating a potential in-memory patch to disable endpoint telemetry.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects PowerShell processes (powershell.exe or pwsh.exe) attempting to execute commands that reference memory manipulation APIs (VirtualProtect, WriteProcessMemory, NtProtectVirtualMemory) or strings associated with AMSI (Antimalware Scan Interface) bypass techniques (amsiscanbuffe, amsiscanstri, amsi.dll). These techniques are commonly used to disable security controls or inject shellcode into memory.
Detects the use of PowerShell command-line arguments and reflection techniques commonly associated with attempting to bypass the Antimalware Scan Interface (AMSI). The rule uses a scoring mechanism to weight various keywords related to .NET reflection and AMSI-specific structures found in the command line.
This rule detects PowerShell commands that attempt to bypass the Antimalware Scan Interface (AMSI) by using .NET reflection techniques. The detection monitors for common class and method names (e.g., 'AmsiUtils', 'Marshal.WriteInt64') utilized by attackers to disable or tamper with AMSI's memory structures within a running PowerShell process.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, obfuscated method calls, and manipulation of internal AMSI/ETW structures (e.g., AmsiScanBuffer, AmsiUtils, Marshal.WriteInt64) within PowerShell Script Block logs (Event ID 4104).
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common reflection-based patterns, such as accessing 'AmsiUtils', modifying 'amsiInitFailed' flags, or using 'BindingFlags' to manipulate non-public members. These techniques are commonly used to disable AMSI scanning within a malicious PowerShell script's memory space.
This rule detects PowerShell script blocks attempting to bypass the Antimalware Scan Interface (AMSI) by dynamically generating and emitting malicious Intermediate Language (IL) code at runtime. It monitors Event ID 4104 for specific patterns, such as the use of 'System.Reflection.Emit', 'AmsiUtils', or 's_amsiInitFailed', which are indicative of techniques designed to manipulate in-memory structures to disable AMSI protections.
This rule detects PowerShell script block execution that attempts to bypass the Antimalware Scan Interface (AMSI) by targeting memory structures. It identifies scripts invoking methods like VirtualProtect, NtProtectVirtualMemory, or WriteProcessMemory in conjunction with AMSI-related functions or DLL references, often indicating an attempt to disable or patch AMSI to execute malicious payloads without detection.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. These techniques typically involve memory manipulation (e.g., using Marshal.WriteInt64) to overwrite AMSI structures within the PowerShell process, effectively rendering AMSI ineffective for script content scanning.
Page 46 of 52