Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects configuration changes on the FortiWeb WAF. Disabling a signature, adding an
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
exclusion or switching a policy to monitor-only removes protection from the
application behind it — and because the application keeps working normally, nothing
else signals that the control has gone.
Onboarding: FORTIWEB is ingested via Syslog (CEF) (Bloo extractor 115).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='FORTIWEB'
and action='CONFIGURATION_CHANGED'
| groupby user, config
Detects policy changes in Trellix ePolicy Orchestrator. ePO governs endpoint
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
protection across the estate, so weakening a policy there disables defences on many
machines at once — far more efficient for an attacker than tampering with hosts
individually, and visible only in ePO's own audit trail.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=iam where sourcename='TRELLIX-EPO' and action='POLICY_UPDATED'
| groupby user, targetuser, role
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts
Detects the loading of the 'truesight.sys' driver from non-standard or temporary locations. This activity is associated with a campaign where threat actors use a vulnerable version of this driver to terminate security products before deploying ransomware or RATs, a technique known as Bring Your Own Vulnerable Driver (BYOVD).
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects use of wmic to add Microsoft Defender scan exclusions via the
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
A transaction code lock was removed through message ID AUQ
Detects execution of esxcli syslog configuration commands where the command
itself is reconstructed at runtime from hex escape sequences, octal escape sequences, an
awk BEGIN block, or a Python chr()-based decoder before being reset against loghost.
CrowdStrike cataloged this pattern across 21 ESX BusyBox obfuscation techniques used to
hide 'esxcli system syslog config set --reset=loghost' from cleartext shell log review.
Threat actors including SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, and Akira use this
to sever centralized log forwarding from a compromised ESXi host immediately before
encrypting the datastore.
itself is reconstructed at runtime from hex escape sequences, octal escape sequences, an
awk BEGIN block, or a Python chr()-based decoder before being reset against loghost.
CrowdStrike cataloged this pattern across 21 ESX BusyBox obfuscation techniques used to
hide 'esxcli system syslog config set --reset=loghost' from cleartext shell log review.
Threat actors including SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, and Akira use this
to sever centralized log forwarding from a compromised ESXi host immediately before
encrypting the datastore.
Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Detects the execution of the Cortex XDR agent administration tool (Cytool) with the 'protect disable' command line argument. This indicates an attempt to manually disable the security agent's protective features on an endpoint, which is a common technique used by adversaries to impair security controls.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects completed administrative actions within the Cortex management console that result in a pause of endpoint protection. This action reduces security coverage on the targeted host and requires validation to ensure it aligns with authorized maintenance, troubleshooting, or incident response activities.
Cortex Agent Exception Rule Created
Cortex XDR
Detects the creation of a new exception rule within the Cortex endpoint agent management configuration. Exception rules can be used to exclude specific files, processes, or behaviors from security prevention policies, potentially leading to a reduction in defensive coverage.
Detects completed administrative actions associated with uninstalling the Cortex XDR endpoint agent. This operation significantly reduces security visibility and defense capabilities on the affected device and requires verification as an authorized action.
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects cross-process memory copy activity via IOCTL code 0x2220C8 or the MmCopyVirtualMemory kernel routine, associated with the Phantom Mantis G13 EDR-killer driver.
This rule detects PowerShell processes attempting to bypass the Antimalware Scan Interface (AMSI) via .NET reflection, specifically targeting 'AmsiUtils' or 'amsiInitFailed' fields. To reduce noise, it correlates this activity with the presence of WinHTTP COM objects (for network evasion) or timing-based functions (e.g., Stopwatch, GetTickCount) often used for anti-sandbox or anti-analysis evasion, characterizing behavior consistent with the ChocoShell malware family.
Page 1 of 60