Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.
Detects disabling Windows Defender Tamper Protection
Detects tamper attempts to sophos av functionality via registry key modification
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Detect the creation of a service with a service binary located in a uncommon directory
Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Detects the removal of Sysmon, which could be a potential attempt at defense evasion
Detects requests to disable Microsoft Defender features using PowerShell commands
Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stopped write events.
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
'Privileged Identity Management (PIM) generates alerts when there is suspicious or unsafe activity in Microsoft Entra ID (Azure AD) organization.
This query will help detect attackers attempts to disable in product PIM alerts which are associated with Azure MFA requirements and could indicate activation of privileged access'
This query will help detect attackers attempts to disable in product PIM alerts which are associated with Azure MFA requirements and could indicate activation of privileged access'
Locate vulnerable Gigabyte drivers used by RobbinHood ransomware to turn off security tools.
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
Identifies potential service tampering related to Microsoft Defender services.
Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/MultipleDataSources/PotentialMicrosoftDefenderTampering.yaml
Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/MultipleDataSources/PotentialMicrosoftDefenderTampering.yaml
Disable Microsoft Office Security Features by registry
Detects attempts to disable AMSI in the command line. It is possible to bypass AMSI by disabling it before loading the main payload.
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
Raccine Uninstall
Sigma
Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.
Page 45 of 60