Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
13
4
4
3
Contributors
7
5
3
2
2
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
23
Products / Services
9
6
5
3
2
MITRE Techniques
13
13
7
7
4
The following analytic detects a potential deletion of firewall rules, indicating a possible security breach or unauthorized access attempt. It identifies actions where firewall rules are removed using commands like netsh advfirewall firewall delete rule, which can expose the network to external threats by disabling critical security measures. Monitoring these activities helps maintain network integrity and prevent malicious attacks.
This analytic detects a process attempting to delete or modify a scheduled task's Security Descriptor (SD) from its registry path. This activity is significant as it may indicate an attempt to remove evidence of a scheduled task for defense evasion. If confirmed malicious, it suggests an attacker with privileged access trying to hide their tracks, potentially compromising system integrity and security. Immediate investigation is required.
Detects the removal of folders from the "ProtectedFolders" list within Windows Defender Exploit Guard's Controlled Folder Access feature. This action could indicate an attacker attempting to bypass security controls to launch an encryption process, manipulate data within a protected folder, or otherwise impair defenses.
Page 2 of 2