Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
311 detections
Filters
Last updated
All Time
Detection languages
184
28
21
21
21
Contributors
88
85
46
21
17
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
259
40
20
6
3
Products / Services
113
76
51
37
35
MITRE Techniques
122
89
87
64
63
CVEs
6
5
3
1
1
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
This rule detects the deployment and activity associated with the TrueSightKiller rootkit, potentially used by threat actors like SilverFox. It identifies several key indicators: the loading of 'truesight.sys' from non-standard directories, the creation of a staging file named 'ranchserv.jpg' in the Windows Temp directory by non-system processes, the presence of the 'truesight.sys' driver based on its known SHA256 hash, and the termination of security products shortly after the creation of TrueSightKiller-related artifacts.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
Detects the rapid termination of multiple known security/EDR agent processes on a single device within a short 5-minute window. This behavior is often indicative of malicious activity, such as ransomware or an attacker attempting to impair defensive capabilities before proceeding with malicious operations.
Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
Detects attempts to terminate security product processes, either through cross-process termination or by executing taskkill.exe targeting security product image names. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection.
Detects a process performing a file access check for 'sbiedll.dll' (indicative of a Sandboxie presence check) followed by the immediate termination of the same process within a 2-minute window. This behavior is highly characteristic of malware attempting to detect if it is being analyzed in a sandbox environment and aborting execution accordingly.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects attempts to terminate security-related processes or stop security-related services using common administrative tools like taskkill.exe, sc.exe, net.exe, or net1.exe. This activity is often indicative of an adversary attempting to disable security monitoring and protection software to facilitate further malicious actions.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
Correlates the loading of a .sys driver with the subsequent rapid termination of security, EDR, and AV processes via the EDR Killer utility.
Detects the use of taskkill to forcefully terminate critical system processes, administrative utilities, or security-related software. The rule tracks command-line patterns involving common targets such as task manager, registry editor, PowerShell, security agents, or attempts to terminate wininit.exe which can trigger a system crash.
Detects the forceful termination of web browsers using taskkill.exe, a common behavior for info stealers attempting to unlock browser databases.
Detects the 'lambsys' malware terminating competing cryptocurrency miner processes (such as xmrig, kinsing, or watchdog) using process termination commands (pkill, kill, killall) from a non-root shell. The detection further correlates this activity with the launch of a new miner binary from temporary directories and subsequent outbound network connections to common mining pool ports.
Detects sandbox evasion via sbiedll.dll presence check (T1497.001) followed by rapid process termination indicating the malware detected a sandbox and aborted execution, as observed in the FortiBleed steganographic loader campaign.
Page 12 of 15