Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Hunts for SimpleHelp executing reg.exe commands to disable Windows Defender components (DisableRealtimeMonitoring, DisableAntiSpyware) prior to encryption.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
This rule detects attempts by user-mode utilities to interact with the loaded EnCase driver via DeviceIoControl, specifically targeting paths containing 'EEDbg' or 'EnCase'. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack, where an EDR killer utility leverages a legitimate driver's functionality to execute arbitrary ring-0 commands, potentially bypassing security controls.
Detects the polymorphic script's initial action: patching the AmsiScanBuffer to prevent Defender from catching the subsequent payload. This rule specifically looks for PowerShell commands containing 'amsiInitFailed' or 'AmsiScanBuffer', which are indicators of attempts to bypass AMSI.
Detects PowerShell utilizing [Runtime.InteropServices.Marshal]::WriteInt32 to overwrite the amsiContext memory space with 0x41414141, indicating an attempt to bypass AMSI.
Detects disabling of Windows Defender through registry modifications
Detects PowerShell commands that modify Quality of Service (QoS) policies targeting the 'ActiveStore'. This technique can be used by adversaries to apply throttling to processes, potentially bypassing EDR solutions without requiring a system reboot, as described in the EDRChoker playbook.
Detects the creation of Quality of Service (QoS) policies via PowerShell that explicitly target known Endpoint Detection and Response (EDR) agent executables. This activity could indicate an adversary attempting to degrade or block EDR telemetry to evade detection.
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
Detects the execution or presence of distinct, custom red-teaming utilities and EDR evasion tools favored by The Gentlemen threat actors. This rule identifies specific filenames and command-line arguments associated with these tools.
Detects the infostealer disabling ETW and AMSI by setting the m_enabled flag to 0 in memory.
Detects attempts to disable Windows Defender features by modifying specific registry values. This rule looks for changes to registry keys under `\Policies\Microsoft\Windows Defender` where values like `DisableAntiSpyware`, `DisableRealtimeMonitoring`, `DisableBehaviorMonitoring`, or `DisableIOAVProtection` are set to '1', indicating an attempt to disable these security features.
Detects disabling of PowerShell command history logging to impair forensics
Hunts for the stager modifying the UserAuthentication registry key to disable Network Level Authentication (NLA) for RDP, lowering security requirements for the attacker.
Detects WMI interactions targeting the MSFT_NetQosPolicySettingData class within the ROOT\StandardCimv2 namespace. The EDRChoker tool abuses this specific WMI class to silently drop EDR telemetry by limiting bandwidth to unworkable speeds (e.g., 8 bits per second), bypassing standard WFP tampering alerts.
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
Correlates the execution of the trojanized scp binary passed with the '!' flag, an internal trigger designed to disable SELinux enforcing mode prior to payload execution. This rule specifically looks for 'scp' command-line executions containing '!' and excludes standard scp syntax that might contain '@' for user@host.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
This rule detects the use of PowerShell to create or modify Quality of Service (QoS) policies, specifically looking for the 'New-NetQosPolicy' cmdlet combined with parameters related to bandwidth throttling ('ThrottleRateActionBitsPerSecond') or application targeting ('AppPathNameMatchCondition'). This activity can be indicative of an attacker attempting to disrupt EDR agent connectivity by severely limiting network bandwidth, a technique associated with 'EDRChoker'.
Detects modification of macOS plist files to hide processes or enable autostart
Page 24 of 60