Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects unauthorized attempts to terminate security-related processes using direct syscalls (ZwTerminateProcess). The rule monitors for processes attempting to access AV/EDR security products with high-level access rights (0x0001 or 0x1fffff) while excluding authorized security processes themselves.
Detects PowerShell or command-line modification of Defender real-time monitoring immediately before ransomware activity. This rule specifically looks for commands that disable real-time monitoring within Microsoft Defender.
Detects unauthorized modification of file flags on core system binaries (e.g., /bin, /sbin, /usr/bin) followed by write/modification operations. This behavior is indicative of an attacker attempting to bypass immutable flags to modify or replace critical system files, often seen in rootkits or malware to achieve persistence or tamper with system integrity.
Detects potential GCP logging sink bucket hijacking by monitoring for the deletion of a Google Cloud Storage bucket followed closely by an update to a logging sink configuration that points to a GCS destination. This pattern is characteristic of attackers attempting to intercept cloud log streams by recreating a target destination bucket in an environment they control.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects VirtualProtect API calls that change the memory protection of ntdll.dll to PAGE_READWRITE. This behavior is commonly associated with EDR unhooking techniques where malware removes hooks placed by security products to monitor system API calls.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Detects the execution of PowerShell commands that use 'ExecutionPolicy Bypass' in conjunction with BitLocker cmdlets 'Get-BitLockerVolume' and 'Suspend-BitLocker'. This combination is indicative of suspicious activity where an adversary attempts to programmatically disable or suspend drive encryption, a behavior often associated with ransomware or data destruction activities.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
This rule detects processes that load 'amsi.dll' while concurrently performing suspicious memory or API activities often associated with AMSI bypass techniques, such as calling 'VirtualProtect' to change memory permissions or using API resolution functions like 'AmsiOpenSession', 'GetProcAddress', or 'GetModuleHandleA'. This pattern is commonly used by adversaries to disable or subvert the Antimalware Scan Interface.
Detects unauthorized modification of the amsi.dll memory space using process access operations such as VirtualProtect. This behavior is a common technique used by malware and scripts to disable the Antimalware Scan Interface (AMSI) in-memory, allowing for the execution of malicious payloads without triggering security product alerts. The rule specifically monitors for sensitive process access granted to amsi.dll originating from high-risk parent processes such as PowerShell, script interpreters, and Microsoft Office applications.
Detects DcRAT loader attempts to disable AMSI scanning by patching the AmsiOpenSession function in amsi.dll memory using VirtualProtect, a technique associated with malware such as DcRAT and historical campaigns like Operation DragonReturn.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
This rule detects attempts to disable PowerShell history logging by using 'Set-PSReadlineOption' with 'HistorySaveStyle' set to 'SaveNothing'. This technique can be used by adversaries to hinder forensic analysis and hide their command execution history.
Detects various methods employed by LCRYX ransomware to disable security software and firewall configurations. The rule identifies suspicious process executions, including PowerShell commands to modify Windows Defender settings, netsh commands to disable firewalls, sc.exe commands to stop security services, and the termination of various antivirus processes (e.g., MsMpEng.exe, avp.exe, bdagent.exe) via taskkill. It specifically monitors these actions when spawned from script hosts like wscript, cscript, or shells like powershell and cmd.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail).
Detects LCRYX ransomware or similar malicious scripts using wscript.exe or cscript.exe to disable Windows security features and system controls via registry modifications, such as disabling UAC, Task Manager, and Registry Tools.
Detects attempts to stop, disable, delete, or configure the Sysmon service using standard administrative utilities (sc.exe, taskkill.exe, or PowerShell). Attackers often perform these actions to blind defensive visibility before executing further malicious activity.
This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.
Page 17 of 60