Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects usage of 'Stop-Service' or 'Remove-Service' powershell cmdlet to disable AV services.
Adversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service
Adversaries may disable security tools to avoid possible detection of their tools and activities by stopping antivirus service
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products
Raccine Uninstall
Sigma
Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.
Detects execution of "reg.exe" to disable security services such as Windows Defender.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.
Detects NetNTLM downgrade attack
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
Page 48 of 60