Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.
Detects modifications to the Windows Registry's Image File Execution Options (IFEO) to inject a debugger for 'agntsvc.exe'. This technique is used by Pay2Key ransomware to hijack and suppress backup agent services, preventing them from functioning during the encryption process.
Detects unauthorized modification of Windows Registry keys intended to disable core administrative tools, including Task Manager, Registry Editor, Command Prompt/Run dialogs, and the Control Panel. Additionally, it identifies the creation of 'DisallowRun' entries used to block security and remediation utilities like Process Explorer, Autoruns, and System Configuration tools.
Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.
Detects modifications to Windows Update registry keys (AUOptions or NoAutoUpdate) by non-Microsoft signed processes. Adversaries may use this to disable automatic security updates, preventing the installation of critical patches to maintain a persistent, vulnerable environment.
Detects modifications to Windows registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or suppressing UAC prompts, when performed by scripting engines like wscript.exe or cscript.exe. This activity is often associated with malware or adversarial post-exploitation efforts to impair defensive capabilities and maintain persistence.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects suspicious execution of MpCmdRun.exe (Windows Defender command-line utility) when it is spawned by an unexpected parent process or executed with arguments commonly used to disable or modify Windows Defender's functionality. This rule aims to identify attempts to impair defenses.
Detects suspicious MpCmdRun.exe command line arguments or execution by unexpected parent processes.
Detects the EDR Killer utility restoring or unhooking user-mode APIs in ntdll.dll (by reading a fresh copy from disk into memory) before it begins communicating with the vulnerable kernel driver. This is identified by a file access event on ntdll.dll in System32 folder, joined with an image load event for EEDbg.sys by the same initiating process.
Identifies the EDR killer utility actively tampering with the Windows Defender registry keys (DisableAntiSpyware, DisableRealtimeMonitoring) after kernel access is achieved. This rule specifically looks for modifications to the 'DisableAntiSpyware' or 'DisableRealtimeMonitoring' registry values under the Windows Defender policy key, setting them to '1' (enabled/disabled respectively), and correlates this with the loading of a '.sys' driver file by the same initiating process.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Detects the use of esxcli or vim-cmd commands on VMware ESXi hosts to power off virtual machines, remove software components (VIBs), or enable maintenance mode. These actions are commonly performed by the Akira ransomware group to disrupt operations and facilitate encryption.
Detects the loading of known vulnerable or unsigned drivers, specifically targeting Huawei-signed driver variants, which have been leveraged by DragonForce for Bring Your Own Vulnerable Driver (BYOVD) defense evasion. The rule identifies driver loads where the file name matches known vulnerable Huawei drivers or where the driver is loaded by an unusual process and not from a standard system directory, and is also untrusted.
This rule detects suspicious executable or DLL file creations in common temporary or user-writable directories shortly after a Microsoft Defender related process (MsMpEng, Nissrv, Werfault, Services) terminates unexpectedly. The rule focuses on the causality chain to link the Defender crash with the subsequent file placement, suggesting an attempt to bypass or disable security software before deploying malicious payloads.
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Page 22 of 60