Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects instances where the Windows Update Service (wusvc.exe) loads amsi.dll, a behavior associated with the Snowlight dropper to facilitate in-memory patching of AMSI functions (AmsiScanBuffer, AmsiInitialize, and AmsiOpenSession) and bypass security scanning.
This rule detects the creation or modification of the 'NoRun' registry value under the Explorer policies key. This policy is used to remove the 'Run' command from the Start Menu, effectively preventing users from launching applications via the standard Run dialog. Adversaries may use this to impair user interaction or as part of a broader defense evasion effort to restrict access to system utilities.
Detects administrative actions that disable or modify Amazon GuardDuty, which could be an attempt to blind security monitoring or evade detection of malicious activity. This includes disabling a detector, deleting publishing destinations, or modifying threat intel and IP sets.
Detects the execution of unsigned binaries located in directories typically excluded from EDR/AV scanning, such as Windows Defender folders, security vendor installation directories, and quarantine locations. Attackers utilize these paths to bypass file-system monitoring and on-execute detection by taking advantage of pre-configured security exclusions.
Detects various methods of disabling or tampering with Windows Defender protections, including modifying preferences via PowerShell (Set-MpPreference), stopping the WinDefend service via sc.exe, terminating the antivirus process via taskkill, or modifying Registry keys associated with Defender policies.
This rule detects unauthorized processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights. Such access is often associated with credential dumping techniques, particularly those utilizing direct syscalls to evade EDR and kernel-level monitoring by bypassing standard Windows API-based detection mechanisms.
Detects the execution of reverse engineering tools like Ghidra, Binary Ninja, or IDA Pro when their command-line arguments reference paths or names associated with EDR sensor drivers, binaries, or services. This behavior is indicative of an adversary conducting analysis of security software to identify potential blind spots or tampering opportunities.
Detects instances where a process opens ntdll.dll directly from the filesystem as a file object. This behavior is indicative of an EDR unhooking technique where an adversary reads a clean, original version of ntdll.dll from disk to overwrite EDR-injected hook bytes in memory, thereby bypassing user-mode monitoring.
This rule monitors registry modifications targeting Windows Defender policies and Sysmon service configuration. Specifically, it tracks attempts to disable real-time protection, anti-spyware features, and service settings commonly used by adversaries to impair security monitoring and defensive tools, characteristic of defense impairment tradecraft.
Detects the modification of the 'NoLogOff' registry value under the Windows Explorer policies key. This policy, when enabled, prevents the 'Log Off' option from appearing in the Start menu, which may be an attempt by an adversary to impair user sessions or lock a user into a specific session on a compromised host.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
Detects unauthorized processes (non-browser related) attempting to modify Chrome/Chromium user profile preference files or sensitive browser registry keys related to search providers and security MACs. This activity is often associated with browser hijacking, malware persistence, or unauthorized manipulation of browser settings.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
Detects the loading of known vulnerable drivers (e.g., ProcessMonitorDriver.sys, inpoutx64.sys) associated with 'The Gentlemen' RaaS group, used in BYOVD attacks to elevate privileges and terminate security products.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, blinding EDR telemetry. This rule specifically looks for WriteProcessMemory API calls targeting ntdll.dll from processes like InstallUtil.exe, MSBuild.exe, and powershell.exe, which are commonly abused for code execution and evasion.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by using reflection to locate and modify the internal 'amsiInitFailed' or 's_amsiInitFailed' fields within the AmsiUtils class. This technique prevents PowerShell from correctly identifying or blocking malicious scripts by forcing the AMSI initialization status to a state indicating a failure has already occurred, effectively disabling the security engine for that session.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
Detects attempts by malicious processes to disable AMSI (Antimalware Scan Interface) by memory-patching the AmsiOpenSession function. The rule monitors processes loading amsi.dll that match known loaders used by DcRAT malware, which use VirtualProtect to alter memory segments in order to bypass security scans of .NET payloads.
This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.
Detects unauthorized modifications to the 'system.conf' configuration file associated with the AnyDesk remote desktop application. Adversaries may modify this file to change AnyDesk settings, specifically to suppress the requirement for user consent when establishing remote interactive sessions, effectively allowing for stealthy persistence and unauthorized remote access.
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Page 5 of 60