Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the creation of a scheduled task designed to run with SYSTEM privileges and terminate common AV/EDR processes. This technique is used by kkRAT for persistence and defense evasion.
Detect the creation of a service with a service binary located in a suspicious directory
This rule detects the creation of Windows Defender Application Control (WDAC) policy files (.cip or .p7b) within the `C:\Windows\System32\CodeIntegrity\` folder by a process running with 'High' integrity. Attackers can leverage this technique to deploy custom WDAC policies that block Endpoint Detection and Response (EDR) components, effectively bypassing security measures and enabling undetected malicious activity after a system reboot.
Detects the usage of command-line tools such as 'net', 'sc', 'powershell', 'wmic', or 'psservice' to stop, pause, disable, or delete critical Windows services. This activity is often observed in ransomware attacks and other malicious campaigns aiming to evade defenses or cause impact by targeting security software, backup solutions, and other essential system services.
The ZoneMap key under Internet Settings is used to define security zones for specific domains. By setting a value under ZoneMap\Domains, you are configuring how Windows handles security and permissions for that domain so it is really helpful to identify if some site has been added via cli manually or by some malicious script to whitelist some domains and bypass some defense.
Detects the creation of a symbolic link in the Windows Defender Platform directory. This is a technique used to hijack the execution flow of Windows Defender, forcing it to run from an attacker-controlled location upon service restart or update.
Detects the loading of the vulnerable RTCore64.sys driver. This driver is exploited by threats like kkRAT to disable AV/EDR security callbacks as part of a Bring Your Own Vulnerable Driver (BYOVD) attack.
This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. After gaining initial access to network devices, threat actors like Static Tundra often modify SNMP configurations to enable unauthorized monitoring and data collection. This detection specifically looks for the configuration of SNMP community strings with read-write (rw) or read-only (ro) permissions, as well as the configuration of SNMP hosts that may be used to exfiltrate data. These activities are particularly concerning as they may represent attempts to establish persistent access or extract sensitive information from compromised devices.
This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. Configuration archive logging captures all changes made to a device's configuration, providing a detailed audit trail that can be used to identify suspicious or malicious activities. This detection is particularly valuable for identifying patterns of malicious configuration changes that might indicate an attacker's presence, such as the creation of backdoor accounts, SNMP community string modifications, and TFTP server configurations for data exfiltration. By analyzing these logs, security teams can gain a holistic view of configuration changes across sessions and users, helping to detect sophisticated attack campaigns like those conducted by threat actors such as Static Tundra.
Detects attempts to disable User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. This technique is used by malware like Salat Stealer to bypass security prompts and perform administrative tasks without user approval.
Detects scenarios where an attacker attempts to disable Defender security service. If tamper protection is enabled, this action may not work.
Detects scenarios where an attacker attempts to stop multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
Detects attempts to disable or modify common security products by reconfiguring their associated Windows service using the Service Control utility (sc.exe). This technique is frequently used by threat actors, including Sinobi ransomware, to evade defenses.
Detects scenarios where an attacker attempts to delete multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
This detection identifies attempts to disable Microsoft Defender Antivirus or bypass its protection mechanisms such as Tamper Protection or Real-Time Protection.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
It leverages signals from Microsoft Defender for Endpoint (via DeviceEvents) as well as Windows Security Events (e.g., Event ID 5001 and 5004), which are triggered when antivirus services are modified or stopped.
Such behavior is commonly associated with defense evasion techniques used by threat actors or unauthorized administrative actions and should be investigated immediately.
Detects scenarios where an attacker attempts to kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
Detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities
Detects scenarios where an attacker attempts to disable Defender security features by modifying service configuration in registry.
Detects scenarios where an attacker tamper Defender RTP protection and disable it.
Detects scenarios where an attacker attempts to disable
Page 38 of 60