Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
This KQL detects potential Microsoft Defender tampering via PowerShell, including attempts to disable real-time or behavior monitoring and add Defender exclusions. It enriches results with tamper type, suspicious PowerShell flags, and confidence level to help prioritize medium/high-confidence activity.
Detects the use of PowerShell to execute the 'Set-MpPreference' command with the 'DisableRealtimeMonitoring' parameter set to true. This technique is commonly used by adversaries to impair Windows Defender security controls and avoid detection during the post-compromise phase.
Detects when the Tamper Protection feature of Windows Defender is disabled. This action is often taken by adversaries or malicious software to weaken endpoint defenses and facilitate further compromise or concealment of malicious activity.
Detects unauthorized attempts to modify Microsoft Defender Tamper Protection registry keys. The rule correlates registry value changes from '5' (Enabled) to '0' or '4' (Disabled) against Microsoft Defender Antivirus Troubleshooting Mode events to distinguish between legitimate administrative troubleshooting and potentially suspicious local tampering.
detects creation of QoS throttle policies in HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\ with ThrottleRate value. pacer.sys enforces these policies at the NDIS layer below WFP, throttling EDR agent bandwidth to near-zero and causing telemetry upload timeouts.
This rule detects activities characteristic of the 'Gentleman' ransomware, including the creation of a specific ransom note file ('README-GENTLEMAN.txt'), attempts to tamper with Windows Defender security preferences, and the destruction of system recovery artifacts such as Volume Shadow Copies and various system logs/prefetch files.
This rule detects tampering with Microsoft Defender by monitoring registry modifications to Image File Execution Options (IFEO) used to attach debuggers to security processes. It also detects the dropping of the 'kvckiller.sys' kernel driver into System32\drivers, which is associated with disabling security software at the kernel level, and the execution of processes containing 'wsftprm' in the command line.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
Detects attempts to tamper with Windows security services and configurations. The rule identifies PowerShell commands used to add Windows Defender exclusions or disable real-time protection, as well as command-line utilities like sc.exe and net.exe used to stop security, antivirus, or EDR services. This behavior is indicative of defense evasion.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
Detects a process that simultaneously loads 'RstrtMgr.dll' and modifies the 'WaitToKillServiceTimeout' registry value within a 2-minute window. This behavior is indicative of an adversary attempting to force system service restarts or accelerate service termination, often seen as part of persistence mechanisms or defensive impairment.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects when multiple security agent processes are terminated on a single host. Monitoring for the simultaneous or rapid termination of security products like Windows Defender, Cylance, SentinelOne, or Falcon suggests an attempt to disable endpoint protections before further malicious activity.
This rule monitors for suspicious activity aimed at disabling or tampering with security software, including antivirus processes and services. It identifies execution of tools named 'AVKiller.exe', the usage of commands like 'taskkill', 'net stop', or 'sc stop' against known security-related processes, and the modification of Windows Defender scheduled tasks to disable security scans.
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Page 3 of 60