Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
55
54
11
10
7
Contributors
46
30
17
7
6
Categories
85
63
41
30
13
Platforms
138
9
9
3
2
Products / Services
44
28
25
19
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the use of reg.exe to query the Windows registry for information related to software versions or service configurations. This activity is often associated with discovery efforts to identify installed software, system configuration, or potential security controls.
Detects reconnaissance activity by Argamal RAT where it enumerates installed security products (AV/EDR) using tasklist.exe or WMI queries (PowerShell or wmic.exe). The rule monitors for processes that target specific security software strings within suspicious process execution contexts.
Detects a potential security software enumeration behavior consistent with the SNOWLIGHT dropper, where a process rapidly requests access (EventID 10) to multiple known security tool processes in a short period.
Detects the SNOWLIGHT dropper process (wusvc.exe) identifying and enumerating various security, analysis, and debugging tools on the system to evade detection.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects instances where a process attempts to access the Avast antivirus directory with SYNCHRONIZE and FILE_EXECUTE flags. This behavior is a known precursor activity for Pay2Key ransomware, which performs security software discovery prior to executing a malicious DLL payload.
Identifies the fake VPN installer using WMI to query SecurityCenter2 to identify installed security products before unpacking the stealer. This rule specifically looks for 'wmiprvse.exe' executing with command-line arguments related to 'AntiVirusProduct' and correlates this with the execution of processes named 'GlobalProtect', 'AnyConnect', or 'VPN'.
Detects reconnaissance activities performed by DcRAT where svchost.exe (as an injection target) or specific suspected malicious process names launch systeminfo.exe or wmic.exe to perform OS version fingerprinting or security software enumeration, such as checking for antivirus products.
Detects WMI reconnaissance commands targeting the SecurityCenter2 namespace (e.g., AntiVirusProduct, FirewallProduct) or system information (e.g., Win32_OperatingSystem) executed via wmic.exe, powershell.exe, or pwsh.exe. This activity is consistent with post-exploitation reconnaissance techniques utilized by DcRAT malware as observed in Operation DragonReturn.
Detects the loader interrogating the process list for a specific cluster of sandbox/analysis tools before proceeding with the infection. This rule specifically looks for PowerShell executing and its command line containing at least two of the listed sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview).
Detects WMI activity where 'wmiprvse.exe' is used to query 'SecurityCenter2' for antivirus product information. This behavior is often associated with adversaries performing reconnaissance to identify security software.
Detects a .NET loader interrogating the process list for a specific cluster of sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview) using PowerShell before proceeding with its malicious activity. The rule triggers when PowerShell command line arguments contain at least two of the specified tools.
Identifies the execution of process enumeration commands ('ps aux' or 'tasklist') spawned by Node.js or Bun environments, a technique used by the Miasma worm to detect running EDR agents before executing credential harvesting routines.
Detects enumeration of AV and security products via WMI
This YARA rule detects the presence of specific strings associated with security drivers and system monitoring tools (ESET, Npcap, Sysmon) within a file or memory. The detection of these strings, particularly in a cluster, suggests an environment reconnaissance activity, potentially by malware like Sessiongate, which might be checking for the presence of security software or network capture tools.
This rule detects attempts to query Windows Firewall status remotely over TCP port 445 (SMB). The detection is based on the presence of the case-insensitive string "FirewallProduct" in the network flow, indicating a potential query for firewall product information. This activity could be part of a reconnaissance phase by an attacker to understand the target's security posture.
This rule detects attempts to query the list of installed AntiVirus (AV) and Endpoint Detection and Response (EDR) products via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'AntiVirus' in the URI, indicating an attempt to use Windows Management Instrumentation Command-line (WMIC) to enumerate security software.
Detects command line activity indicative of probing endpoint detection and response (EDR) software directories such as CrowdStrike, Falcon, Carbon Black, and SentinelOne. The Miasma malware probes these exact paths to fingerprint host defenses before executing its credential theft module.
This rule detects attempts to enumerate security products on a target system via Remote WMI over SMB (port 445). It specifically looks for the string "AntiVirusProduct" in TCP traffic directed to port 445, indicating a potential query for installed antivirus software. This activity is often associated with discovery tactics used by attackers to understand the security posture of a compromised system or network.
Detects WMI queries targeting the SecurityCenter2 namespace to enumerate installed antivirus products. Attackers, such as Seedworm, use this command shortly after initial access to map out defensive tooling before deploying evasive loaders.
Page 5 of 8