Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects processes modifying or querying Windows Defender registry keys related to Potentially Unwanted Application (PUA) protection (PUAProtection, MpEnablePus). This behavior is observed in the SessionGate malware to verify its execution environment and evade detection before deploying further payloads.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Detects registry modifications to Windows Explorer Advanced settings designed to hide file extensions, hidden files, and protected operating system files. This defense evasion technique is commonly used by malware, such as Gamaredon's GammaWorm, to conceal dropped payloads and replaced LNK files from the user.
The “YellowKey” vulnerability disclosed on May 12, 2026, allows attackers with physical access to bypass BitLocker encryption on Windows 11 and Windows Server 2022/2025, gaining full access to protected data without a recovery key or PIN. Microsoft has not yet confirmed the issue or released a patch.
Ref: https://blackfort-tec.de/en/insights/yellowkey-bitlocker-bypass-windows-11-vulnerability
Ref: https://blackfort-tec.de/en/insights/yellowkey-bitlocker-bypass-windows-11-vulnerability
Detects Google Chrome being launched with multiple flags designed to suppress crash dialogs and session restore bubbles. This behavior is indicative of forced browser restarts after a hijacker modifies Secure Preferences, as seen with malware like FlutterShell and Calendaromatic (CL-CRI-1089).
Detects the creation or modification of the 'DontOfferThroughWUAU'
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
AppArmor Profile Removed
Cortex XDR
This rule detects attempts to remove AppArmor profiles. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
Detects unauthorized modification of the Google Chrome Secure Preferences file, specifically targeting the default search provider data to hijack browser searches. This behavior is actively used by malware such as FlutterShell to redirect all Chrome searches to attacker-controlled infrastructure.
This rule detects Attack Surface Reduction (ASR) block events where a file operation was prevented. It specifically filters out audit-only events and excludes operations on .dll and .tmp files to reduce noise. The rule aims to identify malicious activity that ASR has actively blocked, indicating a potential attempt to execute or modify files in a suspicious manner.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Smartcard Disabled Event Detected
Cortex XDR
This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.
This rule detects potential log tampering activities on Linux systems followed by service manipulation within a 20-minute window on the same host.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning. This technique was notably observed in the InstallFix campaign delivering RedLine Stealer.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). This rule monitors for dynamic unloading of the module using 'rmmod' or persistent configuration changes via 'modprobe.d' to disable the module. While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Smartcard Disabled Event Detected
Cortex XDR
This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.
Page 28 of 60