Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects disabling security tools
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects the deactivation of the global auditing state in SAP HANA, which stops all audit logging.
Detects changes to either Global System Changeability (EU1) or Client-Specific Configuration (EU2/SCC4).
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
Detects the use of PowerShell to disable various aspects of Microsoft Defender. This technique is commonly used by malware to evade detection before executing malicious payloads.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
This rule detects the execution of IOBitUnlocker.exe with the '/delete' command-line argument. IOBitUnlocker is a legitimate tool that can be used to unlock and delete files that are otherwise in use or locked by the operating system. Adversaries may weaponize such legitimate tools to delete files, potentially for data destruction, indicator removal, or to hinder forensic analysis.
Detects the execution of devcon.exe with command-line arguments to disable the VMware Virtual Machine Communication Interface (VMCI) PCI device or host device driver. Threat actors use this technique to gain direct hardware access as a preparatory step for VM escape exploits.
Detects Windows Security Center Event ID 15 indicating that a registered security product, such as Windows Defender or VIPRE, has been turned off or snoozed. Attackers actively uninstall or disable endpoint security agents immediately prior to deploying ransomware to ensure successful encryption without interference.
Detects the creation of a system service for NSecKrnl using sc.exe, indicating a potential Bring Your Own Vulnerable Driver (BYOVD) attack. Warlock has been observed utilizing the vulnerable NSecKrnl.sys driver to terminate kernel-level security products before deploying ransomware.
WerFaultSecure should load nearly immediately after EDR-Freeze. This query will correlate PID values instead of time deltas. Since EDR-Freeze requires the PID of an AV/EDR process and WerFaultSecure has to pass a PID to MiniDumpWriteDump so that it can suspend a process, both processes executing will have the same PID in the command line execution. One addition here is to look for the inclusion of dbghelp.dll or dbgcore.dll in the CallTrace field to limit false positive hits.
Detects the creation of the "C:\Nintendo" directory, which is a hardcoded developer backdoor used by the HellsUchecker malware to bypass anti-sandbox and anti-analysis checks.
Detects action of Repo branch protection being disabled by the means of a force push. This would mean no PR or review process is needed and an actor (Insider or attacker) could push arbitrary code.
Detects the loading of specific drivers known to be vulnerable and abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level privileges and disable security tools.
Detects the use of PowerShell to disable or weaken Microsoft Defender security features. This technique is commonly used by malware to evade detection before executing malicious payloads, as seen in the referenced Fortinet report.
Page 31 of 60