Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects changes to the "HVCIDisallowedImages" registry value to potentially add a driver to the list, in order to prevent it from loading. This action is typically performed by adversaries to bypass Hypervisor-Protected Code Integrity (HVCI) and load unsigned or malicious drivers.
This rule detects attempts to disable antivirus filter drivers on a "Dev Drive" by setting the 'FltmgrDevDriveAllowAntivirusFilter' registry value to '0x00000000'. This action prevents antivirus mini-filters from inspecting the Dev Drive, potentially allowing malicious activity to go undetected.
Detects modifications to specific Windows Registry keys that disable or modify features of internal Windows tools. These modifications are often used by malware to hinder system functionality or security mechanisms. The rule looks for changes to registry keys related to disabling the command prompt, control panel, run dialog, log off, password changes, workstation locking, registry tools, task manager, display settings, notification center, UAC consent prompt behavior, inactivity timeout, shutdown without logon, push notifications, and write protection for storage devices. The rule specifically looks for these registry keys being set to a DWORD value of '0x00000001' (to disable features) or '0x00000000' (to enable or modify behavior of certain features like UAC consent prompt, inactivity timeout, shutdown without logon, push notifications, and write protection).
This rule detects the use of the `reg.exe` utility to add or modify registry keys or subkeys in specific suspicious paths. These paths are often abused by adversaries for persistence, defense evasion, or to modify system behavior. The rule specifically looks for modifications to paths related to AppDataLow, Windows Policies, Winlogon, SecurityProviders (WDigest), and Windows Defender.
This analytic detects when classic branch protection rules are disabled in GitHub Organizations. It monitors GitHub Organizations audit logs for `protected_branch.destroy` events, tracking actor details, repository information, and associated metadata. Identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
The following analytic detects the import of Windows PowerShell Applocker cmdlets, specifically identifying the use of "Import-Module Applocker" and "Set-AppLockerPolicy" with an XML policy. It leverages PowerShell Script Block Logging (EventCode 4104) to capture and analyze script block text. This activity is significant as it may indicate an attempt to enforce restrictive Applocker policies, potentially used by malware like Azorult to disable antivirus products. If confirmed malicious, this could allow an attacker to bypass security controls, leading to further system compromise and persistence.
The analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
This analytic detects suspicious PowerShell commands that attempt to delete the Windows Defender directory. It specifically looks for PowerShell Script Block Logging (EventCode 4104) entries containing "rmdir" and targeting paths related to "\Microsoft\Windows Defender". Such activity is critical as it suggests an adversary is trying to disable or corrupt Windows Defender, which is a key security component. If successful, this could allow an attacker to bypass endpoint protection and facilitate further malicious activities without detection.
The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise logs for configuration changes that disable Dependabot functionality. This behavior could indicate an attacker attempting to prevent the automatic detection of vulnerable dependencies, which would allow them to exploit known vulnerabilities that would otherwise be patched. For a SOC, identifying the disabling of security features like Dependabot is critical as it may be a precursor to supply chain attacks where attackers exploit vulnerable dependencies. The impact could be severe if vulnerabilities remain unpatched, potentially leading to code execution, data theft, or other compromises through the software supply chain.
Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects when a Windows Defender exclusion has been deleted. This could indicate an attacker trying to delete their tracks by removing the added exclusions
Detects uninstallation or termination of security products using the WMIC utility
Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet
Detects usage of 'Stop-Service' or 'Remove-Service' powershell cmdlet to disable AV services.
Adversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service
Adversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service
Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
Detects the Setting of Windows Defender Exclusions
Page 41 of 60