Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the loading of amsi.dll by specific suspicious executable names, which may indicate an attempt to interact with or bypass the Antimalware Scan Interface (AMSI).
Detects the loading of amsi.dll in conjunction with command-line arguments that reference sensitive APIs often used to patch or disable the Antimalware Scan Interface (AMSI), such as VirtualProtect, GetProcAddress, or BCrypt-related functions.
This rule detects advanced evasion techniques involving the patching of Native APIs (specifically WriteProcessMemory on ntdll.dll) combined with the spawning of suspended processes (process hollowing). This combination is indicative of attempts to unhook EDRs and execute malicious code stealthily.
Detects potential Anti-Malware Scan Interface (AMSI) bypass attempts by identifying processes modifying the AmsiOpenSession function within amsi.dll memory using VirtualProtect, a technique observed in the DcRAT malware.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, a known evasion tactic to blind EDR telemetry before full execution. This rule specifically looks for WriteProcessMemory API calls targeting memory regions near the base address of ntdll.dll, initiated by processes like InstallUtil.exe, MSBuild.exe, or powershell.exe.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
This rule detects attempts to create symbolic links, junctions, or reparse points that target Microsoft Defender directories such as quarantine, platform, or scan paths. Adversaries may use these techniques to interfere with security tools, evade detection, or manipulate how Defender processes files.
Detects removal and replacement of Chrome.app on macOS to bypass Manifest V3.
Identifies the threat actor executing PowerShell commands to add entire root directories (C:\) to Defender's exclusion list before dropping the ransomware payload.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
Detects PowerShell commands using 'Add-MpPreference' to add exclusions for paths or processes in Windows Defender, which is a common technique for defense evasion by adversaries to prevent security software from scanning malicious files or activities.
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Correlates Run Command execution with immediate subsequent Defender Antivirus tampering on the endpoint. This rule detects attempts to disable or modify Microsoft Defender Antivirus settings using PowerShell commands like 'Set-MpPreference' or 'DisableRealtimeMonitoring' when initiated by 'RunCommandExtension.exe'. This activity is indicative of an attacker attempting to impair defenses.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Detects the initialization of the NetQosCim provider via WMI, which threat actors can use to silently throttle EDR telemetry without terminating the agent.
Page 23 of 60