Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects attempts to tamper with security monitoring mechanisms including AMSI, ETW, and PowerShell Script Block Logging by monitoring process command line arguments for termination or configuration modifications and tracking registry key modifications related to these security features.
Detects PowerShell commands that intentionally disable SSL certificate validation, which can be used by attackers to bypass security controls and trust their malicious HTTPS infrastructure. This technique is often associated with the 'InstallFix' malware.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by performing in-memory patching of the AmsiScanBuffer function within amsi.dll. The rule identifies suspicious memory manipulation operations (VirtualProtect, WriteProcessMemory) performed by script hosts (PowerShell, WScript, CScript) involving PAGE_EXECUTE_READWRITE permissions or specific memory modification patterns (0xB8 opcode patching) indicative of disabling security scanning capabilities.
Detects the use of .NET reflection within PowerShell scripts to manipulate the 'amsiInitFailed' field in 'System.Management.Automation.AmsiUtils'. This technique is a common method to disable the Antimalware Scan Interface (AMSI) for the current process session. The rule monitors PowerShell script block logs for the co-occurrence of AMSI-related classes/fields and specific reflection primitives.
Detects specific PowerShell Script Block Logging (Event ID 4104) patterns associated with Anti-Malware Scan Interface (AMSI) bypass techniques. The rule flags suspicious script content involving DynamicMethod IL emission, Marshal.WriteInt64 memory modification, or reflection-based manipulation of AmsiUtils fields, which are common indicators of attempts to disable or impair security inspection mechanisms in PowerShell environments.
Detects the execution of the Nishang 'Invoke-PowerShellTcp' reverse shell payload via PowerShell. This rule monitors for common obfuscated patterns involving IEX (Invoke-Expression) and 'DownloadString' commonly used to download and execute scripts directly into memory, often following an AMSI bypass attempt.
Hunts for the Python process utilizing ctypes bindings to dynamically resolve VirtualProtect and patch the AmsiScanBuffer. This rule specifically looks for 'WriteProcessMemoryApiCall' events where the initiating process is 'python.exe' and the target memory address is within the 'amsi.dll' module.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects modifications to Windows Registry keys responsible for network interface DNS configuration (NameServer or DhcpNameServer) where a non-corporate, non-private, and non-loopback DNS server is set. This behavior may indicate an attempt to intercept or redirect network traffic, potentially for command and control or man-in-the-middle operations.
Detects modifications to Windows Registry keys responsible for network interface DNS configuration (NameServer or DhcpNameServer) where a non-corporate, non-private, and non-loopback DNS server is set. This behavior may indicate an attempt to intercept or redirect network traffic, potentially for command and control or man-in-the-middle operations.
Detects unauthorized processes modifying the registry value 'PONT_STRING' within the Outlook Options General key. This registry value controls the display of content download warnings in Microsoft Outlook. Modifying this key from a non-Outlook process is a technique used by threat actors, such as APT28, to bypass security warnings and facilitate the execution of malicious payloads or content within Outlook.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects the use of taskkill.exe or tskill.exe to forcibly terminate known security agent processes. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection during post-exploitation activities.
Detects the use of taskkill.exe or tskill.exe to forcibly terminate known security agent processes. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection during post-exploitation activities.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. The detection monitors for the presence of specific keywords and method calls in script content, such as 'AmsiUtils', 'amsiInitFailed', and reflection-based attempts to modify memory buffers used by AMSI to scan for malicious scripts.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for specific keywords associated with memory patching or tampering within the command lines of PowerShell, .NET-based binaries (dotnet.exe, csc.exe, msbuild.exe), and related processes. The rule specifically looks for strings like 'AmsiUtils', 'amsiInitFailed', and base64-encoded equivalents often used by offensive security tools to neutralize AMSI scanning capabilities.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Identifies rapid creation of multiple QoS policies, matching EDRChoker's behavior iterating through process lists. This rule detects when three or more QoS policies are created within a one-minute window on a single device, indicated by the execution of 'New-NetQosPolicy' via PowerShell.
Detects PowerShell referencing AMSI internals, reflection, or amsiInitFailed before executing a downloaded stage. This rule specifically looks for PowerShell processes executing commands that contain keywords related to AMSI bypass techniques, such as 'AmsiUtils', 'amsiInitFailed', 'AmsiScanBuffer', 'amsiContext', 'GetField', combined with 'SetValue', 'Reflection', or 'NonPublic'. This indicates an attempt to modify AMSI's behavior in memory.
Page 20 of 60