Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
260 detections
Filters
Last updated
All Time
Detection languages
111
37
36
21
15
Contributors
72
35
28
28
14
Categories
20,396
11,792
5,863
5,144
4,864
Platforms
223
37
4
2
1
Products / Services
84
73
67
48
34
MITRE Techniques
117
98
85
84
77
CVEs
4
2
1
1
1
IDS Classtypes
6
1
IDS Protocols
7
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects remote attempts to stop sensitive security, database, and system services using the SMB SVCCTL (Service Control Manager) interface. This is often associated with adversary attempts to disable defensive tools or prepare for destructive operations.
Detects Akira ransomware-associated PowerShell script execution that attempts to terminate backup, virtualization, and database services (such as VMware, Veeam, Hyper-V, and MSSQL) and inhibit system recovery by deleting Volume Shadow Copies or disabling boot recovery features.
This rule detects various techniques used by an adversary to clear, truncate, or delete system and audit logs to hide their activity. It monitors for commands targeting Windows Event Logs (wevtutil, Clear-EventLog), Linux system logs (/var/log/ via rm/shred), and journalctl vacuuming, as well as the deletion of .evtx files. It further enriches these detections by identifying if the process was spawned by suspicious parent processes often associated with remote access, lateral movement, or command-and-control activity.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, including real-time monitoring, behavior monitoring, and antispyware features, or attempts to stop/disable the WinDefend service.
Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.
Detects a sequence of actions where a process first enumerates security software (e.g., via WMIC, Registry, or PowerShell) followed by an attempt to stop or terminate security-related services or processes within a short timeframe (5 minutes). This pattern is indicative of an adversary attempting to identify and disable endpoint protection before executing further malicious activity.
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
Detects evidence of log and artifact tampering on a Windows host, specifically the clearing of Windows System or Security logs using wevtutil or PowerShell, the stopping of the EventLog service, or the deletion of PowerShell PSReadLine history files. Such activity is often conducted by an adversary to conceal malicious actions.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe).
Detects remote attempts to stop sensitive security, database, and system services using the SMB SVCCTL (Service Control Manager) interface. This is often associated with adversary attempts to disable defensive tools or prepare for destructive operations.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
This rule detects attempts to disable or interfere with endpoint security products, including Windows Defender and various third-party antivirus agents. It identifies suspicious process executions involving command-line tools like sc.exe, net.exe, or taskkill.exe targeting security services, or the direct modification of Windows registry keys associated with security policy disabling. The detection is further scoped to processes originating from or associated with common suspicious paths (e.g., AppData) or known malicious naming patterns.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.
Page 6 of 13