Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects unauthorized processes modifying the registry value 'PONT_STRING' within the Outlook Options General key. This registry value controls the display of content download warnings in Microsoft Outlook. Modifying this key from a non-Outlook process is a technique used by threat actors, such as APT28, to bypass security warnings and facilitate the execution of malicious payloads or content within Outlook.
Detects modifications to Windows Defender registry keys responsible for defining file, path, process, or extension exclusions. Adversaries often modify these settings to prevent security software from scanning their malicious artifacts.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Detects behavior associated with the Glove Stealer malware, specifically the disabling or modification of Windows Defender, the use of UAC auto-elevate binaries (fodhelper.exe, computerdefaults.exe) initiated by non-standard processes, and unauthorized modifications to Windows Defender registry keys.
Detects suspicious access to wermgr.exe involving Alternate Data Streams (ADS) using the WDFOO tag, or access via Volume Shadow Copy (VSS) paths, often indicative of exploitation attempts related to CVE-2026-50656 where an adversary uses oplocks for race conditions against Windows Defender.
Detects attempts by processes, such as Python or PyInstaller-compiled binaries, to perform in-memory patching of the 'EtwEventWrite' function within 'ntdll.dll'. This technique is used to bypass Event Tracing for Windows (ETW) and suppress security telemetry, a tactic observed in campaigns like Glove Stealer.
Detects the rapid termination of multiple known security/EDR agent processes on a single device within a short 5-minute window. This behavior is often indicative of malicious activity, such as ransomware or an attacker attempting to impair defensive capabilities before proceeding with malicious operations.
Detects the execution of QEMU hypervisor binaries (qemu-system-x86_64, qemu.exe, etc.) when initiated from non-standard parent processes or from non-standard directories, or when associated with disk image files. This behavior may indicate the unauthorized deployment of virtualization software to facilitate lateral movement, data exfiltration, or environment evasion.
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects IronWorm rootkit activity on Linux, specifically focusing on cases where npm or node processes spawn tools like bpftool, insmod, or modprobe to load eBPF programs or kernel modules. It also flags the usage of specific IronWorm-associated filenames (q2.bpf, libbpf) within directories managed by npm or node.
This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.
Detects sign-in events where Conditional Access was not applied for Microsoft Graph access using low-privileged client IDs known to trigger hidden CA exclusions. Tokens issued with only single-factor authentication to Graph indicate exploitation of the hidden scope exclusion behavior introduced when any exclusion is added to an 'All resources' CA policy (CVE-2025-0309). Additionally, this rule identifies audit log events for Conditional Access policy modifications that add exclusions.
Correlates the RMM shell modifying the fDenyTSConnections registry key to force-enable Remote Desktop Protocol for interactive lateral movement.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Page 12 of 60