Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects when branch protection rules are disabled for a GitHub repository.
Detects when components of GitHub secret scanning is disabled for an enterprise or organization.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization.
Detects when vulnerability alerts are disabled for GitHub Dependabot.
Detects when changes are made to a GitHub organization's fine-grained Personal Access Token approval policy.
Detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration.
This rule detects when the Windows Defender service (WinDefend) is disabled by modifying its 'Start' registry key. This is a common technique used by attackers or malware to impair defenses and avoid detection.
This rule identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any applications from the Marketplace. This configuration may increase an organization's risk of data exfiltration/leakage and expand its attack surface by permitting the use of potentially malicious or unapproved third-party applications.
This rule detects attempts to change the 'Altitude' registry value for the Sysmon driver instance. Modifying this value can prevent Sysmon from loading correctly at boot if the new altitude conflicts with other registered services, effectively disabling or impairing its monitoring capabilities. This technique is often used by adversaries to evade detection.
Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Detects the execution of Stracciatella, a hack tool that executes PowerShell runspaces from within C# (SharpPick technique) while attempting to disable AMSI, ETW, and Script Block Logging. Detection is based on the executable's name, original filename, description, or specific SHA256 hashes.
Detects the execution of the GMER tool, a rootkit detector and remover, based on its executable name and known file hashes. This tool can be used by adversaries to impair defenses by identifying and disabling security software or hidden processes.
This rule detects attempts to tamper with Windows Defender settings using PowerShell's Set-MpPreference cmdlet. Specifically, it looks for commands that disable various Defender features like real-time monitoring, behavior monitoring, archive scanning, or set default threat actions to 'Allow'. This activity is indicative of an adversary trying to impair defensive capabilities on a system.
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. This rule specifically looks for the `Set-MpPreference` cmdlet combined with various parameters that disable Defender features or set threat actions to 'Allow'.
Detects changes to the PowerShell execution policy in the Windows Registry to bypass signing requirements for script execution. This rule specifically looks for modifications to the 'ExecutionPolicy' registry values under PowerShell-related paths, setting them to 'Bypass' or 'Unrestricted'. It also filters out changes made by 'svchost' to reduce false positives.
Detects when attackers or tools disable Windows Defender functionalities by modifying specific registry keys. This rule looks for changes to various Windows Defender related registry paths, specifically setting DWORD values to either 0x00000001 (to disable certain features) or 0x00000000 (to disable other features like Tamper Protection or PUA Protection).
This rule detects when the 'RstrtMgr.dll' (Restart Manager) library is loaded by a process that is not part of the common legitimate Windows processes or typical software installation paths. Adversaries, particularly ransomware and wiper malware, have been observed using this DLL to terminate processes that might interfere with their operations, such as file encryption or data destruction. This can include killing processes that lock files, preventing encryption, or for anti-analysis purposes.
Detects the loading of the Windows Restart Manager (RstrtMgr.dll) by a process executing from a suspicious directory. This DLL has been observed in ransomware campaigns (e.g., Conti, Cactus) and wipers (e.g., BiBi) to terminate processes that might lock files, facilitating encryption or data destruction. It could also be used for anti-analysis purposes.
Detects the modification of the "Ime File" registry value within the Keyboard Layouts key to point to suspicious folders. This technique can be used by attackers to load a malicious DLL into a process after sending a WM_INPUTLANGCHANGEREQUEST message, leveraging the Windows Input Method Editor (IME) feature for persistence or defense evasion. The rule specifically looks for DLL paths located in common temporary or user-writable directories, which are often abused by malware.
Detects when Windows Defender Real-time Protection is disabled. This event may not contain detailed information about the initiator, requiring further investigation.
This rule detects attempts to request write access to Windows Defender exclusion registry keys. This activity is highly suspicious as it could indicate an attacker attempting to modify or add new exclusions to bypass antivirus protection. The rule specifically looks for Event IDs 4656 (handle requested) or 4663 (object access attempt) in conjunction with write-related access rights (WriteData or AppendData) on registry paths containing '\Microsoft\Windows Defender\Exclusions\'.
Page 55 of 60