Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects web browsers connecting via Port 80 (HTTP) to domains that strictly mandate HTTPS (HSTS bypass), revealing SSL stripping via DNS hijack. Specifically targets 'login.microsoftonline.com' and 'okta.com'.
Detects attempts to stop the Windows Security Health Service using the 'sc.exe' command-line utility. This service is crucial for Windows security features, and stopping it can indicate an attempt to impair defenses.
Detects attempts to stop the wscsvc (Windows Security Center) service using 'sc.exe'. Adversaries may stop security services to impair defenses and avoid detection.
Detects an attacker disabling Code Access Security (CAS) publisher validation by modifying a .NET .config file, specifically looking for modifications to files ending with '.config' in conjunction with a process command line containing 'generatePublisherEvidence'.
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
Defender exclusion for the Hola path
Cortex XDR
This rule detects attempts to modify Windows Defender preferences to exclude the Hola application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun that include 'add-mppreference', 'exclusion', and 'hola' keywords, indicating an attempt to bypass antivirus scanning for the Hola application.
Detects the use of the New-NetQosPolicy PowerShell cmdlet with parameters designed to aggressively throttle application bandwidth. Attackers can utilize this technique to restrict EDR agent bandwidth to near zero, causing server timeouts while avoiding explicit process termination and bypassing standard WFP tampering alerts.
Detects attempts to unload, disable, or remove kernel drivers, which could indicate a rootkit or other malicious activity trying to hide its presence or impair system defenses. The rule specifically looks for process creation events (EventID 4688) where the command line contains keywords related to driver manipulation ('unload driver', 'disable driver', 'remove driver') and also references kernel components ('.sys', 'kernel').
Detects malicious .config modifications suppressing ETW telemetry and bypassing strong name verification, indicative of the Screening Serpens activity. The rule specifically looks for file modifications to .config files that include specific strings related to disabling ETW and bypassing strong name verification, combined with process command line arguments containing these same strings.
Identifies the creation or modification of unattend.xml files outside of expected deployment directories. This behavior may indicate an attempt to exploit the GreatXML zero-day vulnerability, where attackers place a crafted unattend.xml in the recovery partition to bypass BitLocker during a Windows Defender Offline Scan.
Detects addition of AV exclusion paths to hide malicious files from scanning
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects attempts to stop or disable endpoint security tools, firewalls, or mandatory access control systems (like SELinux/AppArmor) to clear the path for Miasma components. This rule specifically looks for command-line executions using 'systemctl stop' or 'service stop' in conjunction with common security tool names like 'ufw', 'iptables', 'falcon', 'sentinelone', 'apparmor', or 'selinux'.
Captures the scheduled cleanup task executed via cmd to terminate headless Edge instances lacking CoreUIComponents.dll. This activity is associated with the SNOWBELT threat actor group, specifically targeting defense evasion by checking for the presence of a specific DLL.
This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects attempts to disable Defender Real-Time Monitoring by modifying a specific registry key and value. This action indicates an adversary trying to impair defensive capabilities.
Detects attempts to disable Microsoft Defender's Behavior Monitoring feature by modifying specific registry keys. This activity is often indicative of an adversary trying to evade detection by security software.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
Detects attempts to bypass macOS Gatekeeper security controls
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
Page 25 of 60