Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
3
1
Categories
3
1
1
1
1
Platforms
4
Products / Services
4
1
1
MITRE Techniques
4
3
1
CVEs
71
71
64
58
49
Detects various methods of disabling or tampering with Windows Defender protections, including modifying preferences via PowerShell (Set-MpPreference), stopping the WinDefend service via sc.exe, terminating the antivirus process via taskkill, or modifying Registry keys associated with Defender policies.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.