Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects an unusually high volume (10 or more within an hour) of permission changes to files or registry keys by a single user. This activity can be indicative of an adversary attempting to modify access controls to facilitate persistence, privilege escalation, or defense evasion.
Detects PowerShell script block contents indicating the manual bypassing of SSL certificate validation. This defense evasion technique is notably used by the Gamaredon GammaLoad third stage (which executes via an encoded command) to ensure successful connection to potentially untrusted or self-signed C2 infrastructure.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
This rule detects command-line executions that attempt to disable Windows Defender or the Windows Firewall. It specifically looks for process creation events (EventID 4688) where the command line contains keywords like 'disable' along with 'defender' or 'firewall', executed via PowerShell or cmd. This activity is indicative of an adversary attempting to impair defenses.
Detects PowerShell commands attempting to add Windows Defender exclusion paths for directories associated with the 10FXRAT malware. This rule specifically looks for the use of 'Add-MpPreference' with '-ExclusionPath' in the command line, combined with the presence of 'AppNetSvc' or 'WinDiagTrack', which are known directories used by 10FXRAT for staging and persistence.
Detects the execution of Google Chrome with specific command-line flags (--hide-crash-restore-bubble and --disable-session-crashed-bubble) that are often used by malware like FlutterShell to suppress crash recovery prompts and potentially evade detection or user interaction. This behavior can indicate an attempt to hide malicious activity or maintain persistence without alerting the user to abnormal browser states.
Detects disabling of hardware crypto acceleration on network devices
This rule detects attempts to disable Windows Defender via a registry modification, specifically looking for the string "DisableAntiSpyware" in HTTP client body traffic. This activity is often associated with malware or adversary actions to evade defense mechanisms.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
Detects PowerShell commands attempting to disable Microsoft Defender real-time monitoring or adding broad path exclusions, indicating defensive tampering.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
Detects the creation of specific .NET configuration files (.config) used by Screening Serpens for AppDomainManager hijacking, alongside known malicious DLLs. This rule correlates the creation of the campaign's specific config file names with the deployment of its associated payloads in the same folder within a short time frame.
Detects the modification of Windows Explorer registry keys (Hidden, ShowSuperHidden, HideFileExt) designed to conceal files and file extensions. This defense evasion technique is notably used by the Gamaredon group's GammaWorm to hide dropped payloads, replaced LNK files, and malicious directories.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
Page 27 of 60