Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the modification of the 'fDenyTSConnections' registry key using 'reg.exe' to force-enable Remote Desktop Protocol (RDP) on a system, followed by an immediate connection attempt to port 3389. This behavior is indicative of an adversary or RMM-based tool attempting to establish unauthorized remote access for lateral movement.
Detects suspicious command-line activity related to the abuse of Group Policy Objects, including unauthorized GPO creation/linking, modification of GPO registry settings, forced GPO updates, and the staging of files or scheduled tasks within NETLOGON or SYSVOL directories, commonly associated with ransomware deployment or domain persistence.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.
Detects attempts to disable or tamper with security software, including Windows Defender, Windows Firewall, and various third-party antivirus agents, via PowerShell commands, service management utilities, or registry modifications.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
Detects execution of EDRChoker, a tool designed to impair EDR telemetry, when it is passed a process list text file as an argument. The rule specifically looks for command lines containing 'list.txt', an executable name (e.g., 'tool.exe'), and the string 'edr'.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects the silent activation of the 'Smart Window' feature in Mozilla Firefox. The rule monitors for a two-stage sequence where Firefox modifies its 'prefs.js' configuration file to enable the feature, followed shortly by a network connection to the local Smart Window AI API on localhost port 8765.
Detects attempts by the GreenBlood ransomware to disable Windows Defender's real-time monitoring by modifying the registry. This rule specifically looks for 'reg.exe' commands that add 'DisableRealtimeMonitoring=1' to the Windows Defender policy key.
Detects the execution of PowerShell scripts attempting an in-memory AMSI bypass by patching the AMSI scan content handler. The rule identifies suspicious combinations of .NET reflection and memory protection APIs (such as RuntimeHelpers.PrepareMethod, VirtualProtect, and Marshal.Copy) commonly utilized to overwrite AMSI function pointers or return values during runtime.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by nulling the pAppName pointer in memory using Marshal.WriteInt64. This technique forces AmsiScanBuffer and AmsiNotifyOperation to return E_INVALIDARG, causing them to fail open and skip security inspection.
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Detects attempts to bypass AppArmor security profiles using aa-exec to execute processes under restricted contexts (trinity, chrome, flatpak), which is a component of the CVE-2026-46331 (pedit COW) exploit chain. Additionally, it monitors for unauthorized removal or disabling of AppArmor policies via aa-disable, aa-teardown, or apparmor_parser -R, which are often indicative of an adversary attempting to weaken system security to facilitate privilege escalation.
Detects attempts to disable or modify critical Linux security subsystems including SELinux and AppArmor. The rule monitors for the execution of commands such as setenforce, aa-teardown, and systemctl, or direct modifications to security configuration files.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Page 14 of 60