Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects when the 'reg.exe' utility is used to add or modify registry keys or subkeys in suspicious locations. These locations include paths related to AppDataLow, Windows OOBE policies, Winlogon, WDigest security providers, and Windows Defender. Such modifications can be indicative of persistence mechanisms, defense evasion, or other malicious activities.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.
This analytic detects the use of the `taskkill` command to terminate common browser processes (Chrome, Edge, Firefox, Brave, Opera, Chromium). This technique is often employed by malware, such as the Braodo stealer, to close browsers and unlock files containing sensitive information like credentials. Detecting such activity helps security teams investigate and prevent credential theft and system compromise.
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=", "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.
This analytic detects the use of PowerShell commands to add or set exclusions in Windows Defender. It specifically looks for command-line executions containing "Add-MpPreference" or "Set-MpPreference" along with exclusion parameters such as "-Exclusion*", "-ControlledFolderAccessAllowedApplications*", or "-AttackSurfaceReductionOnlyExclusions*". Adversaries commonly use this technique to bypass Windows Defender's protections, allowing malicious code to execute undetected, maintain persistence, and perform further malicious activities without interference from the antivirus.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
The threat actor created an account using the net user command. When a $ is added to the end of the account name during account creation, the account is created with a hidden attribute. In this case, the account cannot be identified using the (net user command), and can only be identified in the SAM registry. In a RID Hijacking attack, threat actors modify the RID value of an account in the SAM registry so that the Windows operating system recognizes it as a changed RID. In the Windows operating system, the registry key related to user accounts are stored in the path HKEY_LOCAL_MACHINE\ SAM\SAM\Domains\Account\Users. The RID of a user account is written in the little-endian format as 4 bytes in the 0x30 0x33 area of the F value under each account key. Threat actors change the value at this offset to the RID of the hijacking target.
This rule detects the usage of the 'SeLoadDriverPrivilege' privilege, which is necessary to load or unload device drivers. This privilege allows a user to dynamically load and unload kernel-mode code, excluding Plug and Play device drivers. The rule aims to identify potentially malicious kernel driver loading by filtering out known legitimate processes and tools. It specifically mentions detecting tools like Ghost-In-The-Logs and Sysinternals, indicating that a whitelist approach is required to reduce false positives.
This specialized KQL query is designed to hunt for a particularly dangerous class of malicious activity: the deliberate disabling of Endpoint Detection and Response (EDR) security controls. It specifically targets the use of tools like EDR Silencer, which attackers deploy to "blind" security tools and operate stealthily on a compromised host. The logic focuses on high-confidence indicators, searching for the tool's executable itself or its distinctive command-line flags (blockedr, unblockall, etc.) when launched by common system interpreters like PowerShell or CMD. By filtering out noisy, legitimate activity related to document processing, this query provides security analysts with a prioritized list of potential EDR tampering incidents, enabling rapid investigation and response to this critical threat.
Detects attempts to tamper with autologger trace sessions by modifying specific registry values. This technique is often used by attackers to disable or impair logging, particularly for Windows Event Log and Windows Defender related logs, to evade detection.
Detects the deletion of a registry key responsible for the 'Scan with Defender' option in the Windows context menu. Attackers may delete this key to hinder users from easily scanning suspicious files, thereby weakening defenses.
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection, which is a defense evasion technique.
NOTE: Big kudos to "Steven Lim @KQLWizard" as he developed the detection and i just adapted the extract regex. at my tests -p was not enough as the parameter was /pid is used.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
Detects potential abuse of LOLBAS techniques (e.g., WerFaultSecure.exe, rundll32.exe, comsvcs.dll) associated with EDR-Freeze attacks. These attacks suspend EDR or AV processes by exploiting Windows Error Reporting to create a race condition, leaving the system unmonitored.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
Detects Olymp Loader defense evasion techniques, such as disabling Windows Defender features or adding broad folder exclusions via PowerShell, and the execution of a known 'Defender Remover' tool.
Detects attempts to suspend or terminate Endpoint Detection and Response (EDR) agent processes by targeting their Process IDs (PIDs). The rule identifies suspicious command-line arguments and tools (e.g., procdump, WerFault) used to interact with processes, specifically looking for these actions against a predefined list of common EDR agent executable names. It correlates process creation events with process ID resolution to identify the targeted EDR agent.
The attack uses WerFaultSecure.exe (Windows Error Reporting component) running with PPL (Protected Process Light) protection at the WinTCB level to call MiniDumpWriteDump on any process, bypassing PPL.
It leverages the CREATE_SUSPENDED flag during process creation and uses OpenProcess with PROCESS_SUSPEND_RESUME to suspend/resume PPL processes.
It leverages the CREATE_SUSPENDED flag during process creation and uses OpenProcess with PROCESS_SUSPEND_RESUME to suspend/resume PPL processes.
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Page 37 of 60