Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the installation of the "Hotta Killer" tool, a Bring-Your-Own-Vulnerable-Driver (BYOVD) process killer used by the Interlock ransomware group to terminate security software. This is identified by the creation of a specific kernel driver file (`UpdateCheckerX64.sys`) and a corresponding Windows service with a distinct naming pattern (`UpdateCheckerX64_{random-numbers}`).
This query detects attempts to disable or modify critical security services using either the 'sc.exe' utility or direct registry modification. This is a common defense evasion technique used by adversaries to weaken a system's security posture before performing further actions.
Traditional Endpoint Detection and Response (EDR) tools primarily monitor live registry APIs (like RegSetValue). Since the attacker modifies the hive file offline and the OS loads it automatically during the logon process, no suspicious registry API calls are ever triggered. This makes the persistence virtually invisible to standard behavioral monitoring until the malicious payload actually executes at logon.
The rule detects the execution of bcdedit.exe with command-line arguments containing both "testsigning" and "on".
Detects deletion of eScan antivirus components, including the Remote Support Utility (tvqsapp.exe), preceded or accompanied by creation of ZIP backups in C:\ProgramData\esfsbk. This behavior may indicate malicious tampering or defense evasion associated with eScan supply chain compromise.
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the execution of 'polers.dll' via rundll32.exe, a command-line pattern used by the Interlock ransomware group's 'Hotta Killer' tool to terminate security software by exploiting CVE-2025-61155.
Detects modification of eScan antivirus database-related registry values, such as setting WTBases_new to an abnormal value (e.g., 999) under the ODS registry key. This behavior may prevent signature updates or force the antivirus engine into an inconsistent state.
Detects behavior consistent with an AMSI bypass where the AmsiScanBuffer function is located and patched in memory to always return an error. This technique disables script content scanning and is commonly used by post-exploitation frameworks and staged malware payloads.
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.
Detects modification of the Windows hosts file to redirect eScan antivirus update servers (e.g., update1.mwti.net) to the non-routable IP address 2.3.4.0. This behavior prevents antivirus updates and is indicative of defense evasion or supply-chain related tampering.
Detects modification of the eScan for Windows MwMonitor registry key to add critical system directories (C:\Windows, C:\Program Files, C:\Program Files (x86)) to antivirus exceptions. This behavior significantly weakens endpoint protection and may indicate malicious tampering or supply-chain abuse.
Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the execution of 'polers.dll' via rundll32.exe, a command-line pattern used by the Interlock ransomware group's 'Hotta Killer' tool to terminate security software by exploiting CVE-2025-61155.
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Detects when the Windows Admin Center service ('SmeSvc.exe') is stopped, and shortly thereafter, a different process starts listening on the WAC port (TCP/6516). This behavior is a key indicator of CVE-2026-20965 exploitation, where an attacker impersonates the service to steal administrator access tokens.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
Detects the creation or modification of a Windows service to belong to a high-priority service group.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Detects the use of PowerShell to add exclusions to Windows Defender. This technique was observed in the PHALT#BLYX campaign where attackers added exclusions for the 'C:\ProgramData' directory and for file extensions like '.exe', '.ps1', and '.proj' to prevent their malware from being detected.
Page 34 of 60