Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.
Detects attempts to disable or modify Microsoft Defender Antivirus security settings through PowerShell commands (Set-MpPreference/Add-MpPreference) or by modifying Windows Registry keys related to Defender exclusions. Attackers often use these techniques to bypass security controls and prevent detection of malicious files or processes.
Detects a specific sequence of commands involving the termination of the AnyDesk process using taskkill, a short delay via the timeout command, and an immediate system reboot. This sequence is often associated with persistence setup or system preparation by threat actors.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects the use of the schtasks utility to modify and disable scheduled tasks related to Microsoft Windows Defender, specifically the scheduled scan, cache maintenance, and verification tasks. This behavior is indicative of an attempt to impair security defenses on a Windows host.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by invoking memory manipulation techniques. The rule monitors for the usage of 'VirtualProtect', 'GetProcAddress', and 'LoadLibrary' in combination with AMSI-specific strings (e.g., 'AmsiScanBuffer', 'amsi.dll') and the .NET 'Runtime.InteropServices.Marshal' namespace, which are indicative of an in-memory AMSI patch or obfuscation.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
Detects processes attempting to masquerade as legitimate Cortex XDR components by including vendor-specific internal paths (e.g., cyserver, tdevflt) in their command-line arguments. Attackers may use this technique to trick endpoint security products into bypassing telemetry collection or applying incorrect exclusion policies based on matching path patterns.
Detects the use of taskkill.exe to forcibly terminate a process named 'svehost.exe'. This is often used by adversaries to terminate a process masquerading as a legitimate system process, or potentially an attempt to terminate an impostor service. Note that 'svehost.exe' is a common typo/masquerade for the legitimate 'svchost.exe'.
Detects execution of PowerShell commands that contain strings indicative of an in-memory AMSI (Antimalware Scan Interface) bypass. The rule searches for the combination of memory manipulation API calls (VirtualProtect, LoadLibrary, GetProcAddress) and specific byte signatures (0xB8, 0xC3) often used to patch AMSI in the current process memory.
This rule monitors for the execution of known software utilities often used by adversaries to disable security controls, remove system locks on files, or tamper with security configurations. Specifically, it flags the usage of IObit Unlocker, Gmer (a known rootkit/tampering tool), and Defender Control (used to disable Windows Defender).
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
Detects the manual or malicious termination of security-related processes, including antivirus software, endpoint protection agents, and diagnostic/monitoring tools (e.g., Task Manager, Process Explorer, Wireshark). Such behavior is often indicative of an adversary attempting to impair security defenses to facilitate further malicious activity.
Detects attempts to disable or tamper with Microsoft Defender by terminating its processes, stopping its associated services, adding directory exclusions, or modifying registry keys used to control its behavior and security settings.
Detects the loading of the known vulnerable OPSWAT AppRemover driver (pcdhost.sys). This driver is often abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks, such as those performed by ResiLoader, to execute code in kernel mode and bypass security controls, ultimately allowing the termination of protected security processes.
Detects the use of reg.exe to modify Windows Registry keys related to disabling or tampering with Windows Defender security settings, such as Real-time Monitoring, Tamper Protection, and various scanning features.
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
Detects attempts to disable Windows Defender real-time protection, behavior monitoring, or scan capabilities. This is achieved by monitoring for specific HKLM registry modifications under 'SOFTWARE\Policies\Microsoft\Windows Defender' or the execution of PowerShell cmdlets 'Set-MpPreference' and 'Add-MpPreference' with arguments designed to disable security features or add file/process exclusions, often observed during initial stages of ransomware attacks.
Detects the execution of PowerShell with security-bypassing flags (-ExecutionPolicy Bypass, -NoProfile, -WindowStyle Hidden) launched by the Windows Script Host (wscript.exe). This pattern is associated with the VEIL#DROP campaign where JavaScript lures invoke PowerShell to bypass AMSI and security controls.
Page 4 of 60