Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
55
54
11
10
7
Contributors
46
30
17
7
6
Categories
85
63
41
30
13
Platforms
138
9
9
3
2
Products / Services
44
28
25
19
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.
This detection focuses on the keywords that the attacker might use as a filter.
This query finds a software by name and/or version
To evade security software and analyst tools, Nobelium malware enumerates the target system looking for certain running processes, loaded drivers, and registry keys, with the goal of disabling them.
The Microsoft Defender for Endpoint sensor is one of the processes the malware attempts to disable.
Microsoft Defender for Endpoint has built-in protections against many techniques attackers use to disable endpoint sensors ranging from hardened OS protection, anti-tampering policies, and detections for a variety of tampering attempts, including "Attempt to stop Microsoft Defender for Endpoint sensor", "Tampering with Microsoft Defender for Endpoint sensor settings", or "Possible sensor tampering in memory".
Successfully disabling Microsoft Defender for Endpoint can prevent the system from reporting observed activities.
However, the multitude of signals reported into Microsoft Defender XDR provides a unique opportunity to hunt for systems where the tampering technique used might have been successful.
The following advanced hunting query can be used to locate devices that should be reporting but aren't:
The Microsoft Defender for Endpoint sensor is one of the processes the malware attempts to disable.
Microsoft Defender for Endpoint has built-in protections against many techniques attackers use to disable endpoint sensors ranging from hardened OS protection, anti-tampering policies, and detections for a variety of tampering attempts, including "Attempt to stop Microsoft Defender for Endpoint sensor", "Tampering with Microsoft Defender for Endpoint sensor settings", or "Possible sensor tampering in memory".
Successfully disabling Microsoft Defender for Endpoint can prevent the system from reporting observed activities.
However, the multitude of signals reported into Microsoft Defender XDR provides a unique opportunity to hunt for systems where the tampering technique used might have been successful.
The following advanced hunting query can be used to locate devices that should be reporting but aren't:
Device Network Events Involving Low Count FQDNs.
This query reduces network events to only those with the RemoteURL column populated,.
Then parses the DNS name from the URL (if needed) and finds the least prevalent.
FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous.
Network communication.
This query reduces network events to only those with the RemoteURL column populated,.
Then parses the DNS name from the URL (if needed) and finds the least prevalent.
FQDNs. The result is then joined with DeviceNetworkEvents to highlight anomalous.
Network communication.
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes.
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus
Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).
This query uses the public MDE GitHub repo as a source to estimate the time that an agent build remains supported
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
'Provides the Security Intelligence version and total count of up to date devices, not up to date devices and count of devices whose status is not available relevant to the security intelligence version.'
Find Endpoints policies settings via compliance settings in the registry
Detects the execution of WMIC to enumerate installed firewall, antivirus, and antispyware products. Adversaries often perform this discovery to understand security controls, plan evasion tactics, or disable protection mechanisms.
Detects the use of `csrutil` with the `status` argument to view the System Integrity Protection (SIP) status on macOS. This activity is often observed in post-exploitation scenarios where an adversary is attempting to understand the system's security posture, specifically whether SIP is enabled or disabled, which could impact their ability to perform certain actions like modifying system files or injecting code.
Detects when the `csrutil` command is used with the `disable` argument to turn off System Integrity Protection (SIP) on macOS. This action is often performed in post-exploitation scenarios by adversaries to gain greater control over the system or to bypass security mechanisms.
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.
This rule detects the execution of `find.exe` or `findstr.exe` on Windows systems when used to search for keywords commonly associated with security tools. Attackers often use these utilities to discover installed security software by piping the output of other reconnaissance commands (like `tasklist` or `whoami`) through `findstr` to filter for specific terms. The rule specifically looks for command-line arguments containing keywords such as "avira", "cb", "cylance", "defender", "kaspersky", "kes", "mc", "sec", "sentinel", "symantec", and "virus", including variations with double quotes.
This rule detects PowerShell scripts that attempt to discover security software installed on a system. Specifically, it looks for the use of 'Get-Process' (or its alias 'gps') piped to 'Where-Object' (or its alias '?') to filter processes based on keywords commonly associated with security products such as 'avira', 'carbonblack', 'cylance', 'defender', 'kaspersky', 'malware', 'sentinel', 'symantec', and 'virus'. The filtering can be applied to process properties like Company, Description, Name, Path, or Product. This activity is indicative of an adversary attempting to enumerate defensive tools present on the system.
Detects the use of the 'grep' utility on macOS to search for common security software names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised system.
Detects the use of `grep` or `egrep` commands on Linux systems to search for common security software process names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised host.
This rule detects the execution of 'wmic.exe' with the 'Product' keyword in the command line. This specific command is often used by adversaries to enumerate installed software, including security products like firewalls and antivirus, on a Windows system. This activity is typically part of the discovery phase of an attack, where an attacker gathers information about the environment to plan subsequent actions.
Detects the usage of "findstr" with the argument "385201", which is the default driver altitude for Sysinternals Sysmon. This activity could indicate an adversary attempting to discover if Sysmon is installed on a system, even if the service name has been changed.
Page 7 of 8