Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Detects execution of "reg.exe" to disable security services such as Windows Defender.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Detects attackers attempting to disable Windows Defender using Powershell
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.
Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.
Detects the removal of Sysmon, which could be a potential attempt at defense evasion
Detects commands that temporarily turn off Volume Snapshots
Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless
Detect the creation of a service with a service binary located in a suspicious directory
Detects disabling Windows Defender Exploit Guard Network Protection
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.
Detects registry modifications that disable Privacy Settings Experience
Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings
Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections
Page 46 of 60