Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
Detects modifications to the Windows Defender exclusion list via registry keys. Adding exclusions can be used by attackers to hide malicious files, processes, or directories from antivirus scanning.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell sessions by monitoring for common indicators such as manual manipulation of AmsiUtils, AmsiScanBuffer, or reflection-based patching techniques. This activity is indicative of an adversary attempting to execute malicious code without security interference.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell sessions by monitoring for common indicators such as manual manipulation of AmsiUtils, AmsiScanBuffer, or reflection-based patching techniques. This activity is indicative of an adversary attempting to execute malicious code without security interference.
This rule detects attempts to unhook or tamper with Native APIs by monitoring 'WriteProcessMemory' calls targeting 'ntdll.dll'. This technique is often used by adversaries to evade EDR (Endpoint Detection and Response) solutions by disabling their API monitoring capabilities.
Detects the creation or loading of a driver named Havoc.sys in a temporary directory, or the loading of a known vulnerable Huawei audio driver (HWAuidoOs2Ec.sys) identified by its SHA256 hash. This activity is indicative of the Havoc Process Terminator BYOVD tool, often used in recent campaigns to blind EDR solutions.
Detects the addition of broad exclusion paths to Microsoft Defender, specifically targeting drive roots, administrative shares, or common working directories. This activity is often associated with ransomware, such as the 'Gentlemen Ransomware', to evade detection.
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
Detects execution of New-NetQosPolicy in PowerShell, indicative of EDRChoker QoS throttling, which can be used to impair defenses.
Detects PowerShell command lines attempting to disable AMSI (Antimalware Scan Interface) by leveraging 'AmsiUtils' and 'amsiContext'. This technique is often used by adversaries to evade security controls that rely on AMSI for script scanning.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Correlates the malware attempting to permanently disable macOS system-wide Gatekeeper functionality (spctl --master-disable).
Detects commands modifying the fDenyTSConnections registry key to forcefully enable Remote Desktop Services on the victim host using 'reg.exe'.
Detects the loading of amsi.dll into a process, excluding common trusted security processes. This behavior is often indicative of an attempt to interact with or bypass the Antimalware Scan Interface (AMSI) by non-security software, which can be a precursor to executing obfuscated scripts or malicious code.
This rule detects suspicious activity involving the loading of amsi.dll in conjunction with memory protection changes (VirtualProtectApiCall) that often signify an attempt to patch or disable the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for remote thread creation, memory protection modifications involving 'AmsiScanBuffer', and executable memory page allocation within 30 seconds of loading amsi.dll, excluding known trusted Microsoft processes.
Detects instances where suspicious processes load the amsi.dll module, which is a common precursor to performing in-memory patching of the AmsiScanBuffer function. This behavior is indicative of an attempt to disable Anti-Malware Scan Interface (AMSI) to evade security scanning, specifically observed in techniques like the SNOWLIGHT dropper.
Detects the execution of cmd.exe or powershell.exe where the command line contains references to the Avast directory. This behavior may indicate an attempt to tamper with, interact with, or bypass security software components.
Detects a registry modification where Pay2Key ransomware sets the 'shutdownwithoutlogon' value to 0 under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. This action disables the shutdown option in the Windows Start menu, a tactic used by the ransomware to maintain access to the infected system and ensure encryption processes are not interrupted by a reboot.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Detects the loading of amsi.dll by a non-Microsoft signed process. This behavior is indicative of processes attempting to hook or patch AMSI (Antimalware Scan Interface) functions in memory to evade detection, a technique commonly used by malware droppers to neutralize security scanning.
Detects the specific behavior associated with the TrymeLocker malware DestroyCMD function, which involves stripping file permissions from cmd.exe using takeown and icacls, followed by the deletion or renaming of cmd.exe within the System32 or SysWOW64 directories to disable command execution.
Page 21 of 60