Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects obfuscated PowerShell commands used to disable security features, such as AMSI bypass, disabling TLS certificate validation, and enabling Restricted Admin mode. This behavior is a known TTP of the Qilin ransomware group.
VM Escape VMware VMCI Device Disabling
Cortex XDR
This rule detects attempts to disable VMware VMCI (Virtual Machine Communication Interface) devices using 'devcon.exe'. This activity can be indicative of a VM escape attempt, as disabling VMCI might be a step to bypass security mechanisms or facilitate further exploitation within a virtualized environment. The rule specifically looks for 'devcon.exe' executing with 'disable' in the command line, targeting either 'PCI\VEN_15AD&DEV_0740' (VMCI device) or 'ROOT\VMWVMCIHOSTDEV' (VMCI host device).
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects PowerShell commands used to add exclusions to Windows Defender or disable real-time monitoring. This is a known defense evasion technique (T1562.001) used by adversaries, including the PHALT#BLYX campaign, to allow malicious components to operate without being detected.
Detects the use of the Microsoft Device Console (devcon.exe) to disable VMware Virtual Machine Communication Interface (VMCI) devices. This is a preparatory step observed in the 'MAESTRO' toolkit to gain exclusive hardware access before loading a malicious driver for a VM escape exploit.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
Detects the tampering of the Microsoft Defender file system mini-filter driver's 'Altitude' registry value. The HoneyMyte APT's rootkit sets this value to '0' to prevent the driver from loading, effectively impairing system defenses.
Detects modifications to critical registry settings that weaken security controls related to NTLM authentication, Restricted Admin mode, and RDP security. The rule specifically looks for disabling NTLM traffic restrictions (RestrictSendingNTLMTraffic set to 0), disabling Restricted Admin mode (DisableRestrictedAdmin set to 0), or weakening RDP security by setting the SecurityLayer to '1'. An alert is generated if two or more such modifications occur within a 7-day timeframe.
Detection Looks for powershell been used to disable AV/Defender within a system or evade detection through excluding drives/files. Actors will use this to bypass defenses or set up file exclusions to allow their custom files/binaries to execute.
This KQL query identifies potential Bring Your Own Vulnerable Driver (BYOVD) activity associated with the Shanya packer by detecting the creation/modification of known vulnerable or malicious driver files (e.g., ThrottleStop.sys, rwdrv.sys, hlpdrv.sys) and their subsequent loads, a technique used to gain kernel access for disabling EDR/AV tools in ransomware attacks.
Detects the execution of the command to stop the vCenter remote management service (vpxa) on an ESXi host. This is a technique used by the RansomHouse MrAgent tool to inhibit system recovery and impair defenses before deploying the Mario encryptor.
Detects modifications to the Windows Registry that disable critical security features, specifically related to Restricted Admin Mode, UAC remote token filtering, and DSRM logon behavior. Ink Dragon uses these modifications to facilitate lateral movement and maintain domain dominance.
Detects the execution of "ClipUp.exe" with specific command-line parameters used to abuse Protected Process Light (PPL) to tamper with the Microsoft Defender process ("MsMpEng.exe"). This technique was observed in the RONINGLOADER campaign.
Detects attempts to disable Windows Defender's real-time monitoring feature by modifying its corresponding registry key. This technique is commonly used by malware, such as FormBook RAT, to evade detection.
Detects behaviors associated with the LCRYX VBScript ransomware, including modification of the hosts file to block security sites and the download of additional malicious payloads from known malicious URLs.
Detects a Python process creating a scheduled task or adding a Windows Defender exclusion, a technique used by malware like InvisibleFerret for persistence and defense evasion.
This query looks for DISM enable & disable events on the same device within a 15-minute window.
Detects the enablement of the Hyper-V feature, particularly when the management clients are disabled simultaneously. This combination of actions is a technique used by the Curly COMrades threat actor to create a hidden virtualized environment for evasion purposes.
Detects Cephalus ransomware behavior, specifically the deletion of Volume Shadow Copies and tampering with Windows Defender settings, which are common precursor activities to encryption.
This detection identifies command-line activity consistent with attempts to stop, uninstall, or otherwise tamper with the CrowdStrike Falcon agent. It looks for specific commands and utilities (sc.exe, net.exe, powershell.exe, falconctl.exe, taskkill) used in conjunction with CrowdStrike-related keywords to detect attempts to disable, uninstall, or terminate the agent's processes or services.
Page 35 of 60