Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects Windows devices running an antivirus platform version that is not '4.18.26030.3011'. This could indicate an outdated antivirus installation, which might be a result of defense evasion tactics or a failure in update mechanisms, leaving the system vulnerable.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825
Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.
Detects attempts to disable Windows EventLog autologger sessions via registry modification.
The AutoLogger event tracing session records events that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
The AutoLogger event tracing session records events that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel
Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging.
The AutoLogger event tracing session records events up that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
The AutoLogger event tracing session records events up that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.
Detects the classic Matt Graeber AMSI bypass technique using reflection to set amsiInitFailed to True. This one-liner disables AMSI scanning for the entire PowerShell session.
Detects the execution of Google Chrome with the '--simulate-outdated-no-au' command-line argument. This flag is used to disable Chrome's auto-update mechanism, a technique observed being used by adware and malware, such as Dragon Boss Solutions payloads, to lock users into a modified, vulnerable browser version.
Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell.
AMSI provides a generic interface for applications and services to integrate with antimalware products.
Adversaries may disable AMSI to evade detection of malicious scripts and code execution.
AMSI provides a generic interface for applications and services to integrate with antimalware products.
Adversaries may disable AMSI to evade detection of malicious scripts and code execution.
Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe.
HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.
Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.
HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.
Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
Detects the full kill-chain used by modern ransomware operators (RansomHub, LockBit affiliates, BlackCat/ALPHV, FIN7) who deploy EDR killers (EDRKillShifter, AvNeutralizer/AuKill, Terminator, RealBlindingEDR, GhostDriver/Poortry, Backstab) in the pre-encryption phase. These tools use the BYOVD (Bring Your Own Vulnerable Driver) technique — loading a legitimately-signed but vulnerable kernel driver (rtcore64.sys, gdrv.sys, truesight.sys, dbutil_2_3.sys, mhyprot2.sys, procexp152.sys, aswarpot.sys, zam64.sys) as a kernel service, then abusing its IOCTLs to terminate protected EDR processes from kernel space, bypassing PPL. This pack contains 10 queries covering vulnerable driver loads, drivers dropped to user-writable paths, kernel service creation, known EDR-killer binaries, Defender/EDR service tampering, mass security-process termination bursts, unsigned kernel loads, registry-based Defender tampering, full driver→service→kill chain correlation within 1h, and a hash-free behavioural catch-all (unsigned loader → sc.exe create kernel service within 60s).
Detects when the "Windows Defender Threat Protection" service is disabled.
Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Detects attackers attempting to disable Windows Defender using Powershell
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value.
Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.
Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.
Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.
Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.
Detects the usage of Cloud Files API (CfRegisterSyncRoot or CfConnectSyncRoot) by untrusted applications. This technique is notably used by the BlueHammer LPE zero-day to set a timing trap and freeze Windows Defender.
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Page 30 of 60