Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
90
65
32
11
10
Contributors
44
31
29
23
20
Categories
87
85
84
64
29
Platforms
183
28
17
6
5
Products / Services
48
48
38
38
19
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects remote attempts to stop sensitive security, database, and system services using the SMB SVCCTL (Service Control Manager) interface. This is often associated with adversary attempts to disable defensive tools or prepare for destructive operations.
Detects Akira ransomware-associated PowerShell script execution that attempts to terminate backup, virtualization, and database services (such as VMware, Veeam, Hyper-V, and MSSQL) and inhibit system recovery by deleting Volume Shadow Copies or disabling boot recovery features.
Detects remote attempts to stop sensitive security, database, and system services using the SMB SVCCTL (Service Control Manager) interface. This is often associated with adversary attempts to disable defensive tools or prepare for destructive operations.
This rule detects when a single computer executes 5 or more process termination commands (taskkill or Stop-Process) within a one-hour window. This behavior can be indicative of an adversary attempting to disrupt system operations or evade defenses by stopping security tools or critical services.
Identifies when a application is deleted in Azure.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects anomalous activity where a process or user attempts to stop or disable multiple security-related services (e.g., Windows Defender, Sysmon, EDR agents) within a short window. This behavior is indicative of an adversary attempting to impair defensive monitoring and protection tools during a compromise.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
Detects Reynolds ransomware terminating hardcoded EDR/AV process names via its NSecKrnl kernel driver. The rule identifies process terminations of known security software executables and correlates it with the presence of the '402.sys' driver in the 'C:\ProgramData' folder, which is associated with the NSecKrnl driver used by Reynolds ransomware.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
Detects disabling of Linux audit daemon to remove security monitoring
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
This rule detects attempts by the Rokarolla trojan to disable Google Play Protect on Android devices. It monitors for Accessibility Service actions, Android Accessibility Events, or App Control Actions that target 'com.google.android.gms' and contain keywords like 'play_protect', 'PlayProtect', 'finskyEula', 'security_scan', or 'disable'. This behavior indicates the malware is trying to suppress security scans by Google Play Protect.
Detects suspicious command-line activity involving 'cmd.exe' executing a batch file named 'cleanup_greenblood.bat' or other batch files from temporary directories with specific cleanup-related commands. This pattern is often associated with malware or post-exploitation cleanup activities.
Detects unauthorized or suspicious use of virtualization management tools (e.g., esxcli, vim-cmd, PowerShell cmdlets for vSphere/Hyper-V) to perform disruptive actions such as powering off VMs, removing snapshots, or modifying firewall configurations. The rule excludes activity originating from standard management processes and trusted VMware/Microsoft signed processes.
Detects unauthorized or suspicious use of virtualization management tools (e.g., esxcli, vim-cmd, PowerShell cmdlets for vSphere/Hyper-V) to perform disruptive actions such as powering off VMs, removing snapshots, or modifying firewall configurations. The rule excludes activity originating from standard management processes and trusted VMware/Microsoft signed processes.
Page 4 of 12