Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects the use of the Deployment Image Servicing and Management (DISM) tool, specifically 'Dism.exe' or 'DismHost.exe', with command-line arguments indicating an attempt to disable features or remove packages from a running Windows operating system ('/Online' and '/Disable-Feature'). This activity can be indicative of an adversary trying to impair defenses by disabling security features or removing security-related components.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could disable these warnings to run malicious Python code within spreadsheets without user notification, leveraging the new Microsoft Excel feature that allows Python execution.
Detects attempts to bypass AMSI (Antimalware Scan Interface) using .NET reflection. This technique involves manipulating the 'amsiInitFailed' field within 'System.Management.Automation.AmsiUtils' to disable AMSI scanning, often seen in PowerShell scripts to evade detection.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed in Microsoft Excel. Threat actors could leverage this to run malicious Python code within Excel without user notification.
This rule detects attempts to disable security tools on macOS systems. It specifically looks for the use of '/bin/launchctl' to 'unload' security-related plists (property list files) associated with common security software like Objective-See's LuLu and BlockBlock, Google Santa, Carbon Black, Little Snitch, Tenable Nessus, OpenDNS Umbrella, Crowdstrike Falcon, osquery, Filebeat, Auditbeat, Packetbeat, and td-agent. Additionally, it detects attempts to disable macOS Gatekeeper using '/usr/sbin/spctl' with the 'disable' argument.
This rule detects attempts to disable logging on Cisco devices by looking for specific commands such as 'no logging' or 'no aaa new-model'. Adversaries may disable logging to evade detection and hinder forensic analysis.
Detects the execution of the PowerTool utility, which is known for its capabilities to terminate processes, delete process and driver files, and unload drivers. This tool is often used by adversaries for defense evasion and system manipulation.
This rule detects blocked attempts to modify Microsoft Defender Antivirus settings when Tamper Protection is enabled. Specifically, it looks for Event ID 5013 from the Windows Defender service, which indicates that Tamper Protection has blocked a change to Defender's configuration. The rule targets attempts to disable key features such as AntiSpyware, AntiVirus, archive scanning, network file scanning, real-time monitoring, behavior monitoring, IOAV protection, and script scanning by monitoring specific registry value paths.
Detects the use of the 'reg.exe' utility to delete SafeBoot registry keys. This activity is often performed by attackers to disable security products or interfere with system recovery mechanisms, particularly in the context of defense evasion.
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server. This action is a strong indicator of an adversary attempting to evade detection by tampering with logging mechanisms.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects the use of PowerShell cmdlets 'Add-MpPreference' or 'Set-MpPreference' in conjunction with parameters like '-ExclusionPath', '-ExclusionExtension', '-ExclusionProcess', or '-ExclusionIpAddress' to configure exclusions for Microsoft Defender Antivirus. This activity is often associated with defense evasion tactics used by adversaries to prevent security software from detecting their malicious activities.
Detects the use of 'reg.exe' to add or copy registry keys within the 'SafeBoot' path. This activity is often associated with ransomware attempting to ensure persistence or functionality in Windows Safe Mode, potentially to bypass security products that do not operate in that mode.
This rule detects when a file is restored from quarantine by Microsoft Defender Antivirus. This action is logged with Event ID 1009 in the Microsoft-Windows-Windows Defender/Operational event log. While legitimate administrators might restore files, this event can also indicate an adversary attempting to reintroduce malicious files that were previously quarantined, potentially as part of a defense evasion strategy.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe) as indicated by an Application Error event (EventID 1000) containing both 'MsMpEng.exe' and 'mpengine.dll' in the event data. Such crashes could be indicative of an attempt to bypass or disable antivirus defenses, potentially through exploitation of vulnerabilities in the engine.
This rule detects events indicating issues with Windows Defender Real-Time Protection features. Specifically, it triggers when Real-Time Protection encounters an error and fails (EventID 3002) or when a Real-Time Protection feature restarts (EventID 3007). It filters out common false positives related to Network Inspection System errors due to missing updates or unknown antimalware security intelligence issues.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe), specifically when the mpengine.dll module is involved. Such crashes can indicate an attempt to exploit vulnerabilities in the antivirus software to bypass security defenses or disable the tool. The detection relies on Windows Error Reporting (EventID 1001) logs containing specific process and module names.
Detects a typical pattern of a Cobalt Strike Beacon Object File (BOF) attempting to inject into other processes. This rule specifically looks for process access events where the call trace indicates a sequence from ntdll.dll to KERNELBASE.dll, followed by an unknown module, combined with specific granted access rights (0x1028 or 0x1fffff). This pattern is indicative of certain process injection techniques used by Cobalt Strike BOFs.
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
This rule detects registry modifications associated with the Ke3chang/TidePool malware families. Specifically, it looks for command-line arguments used to modify the 'Check_Associations', 'DisableFirstRunCustomize', and 'IEHarden' registry keys. These modifications are known to be unique to these malware families and were observed in campaigns in 2019 and 2020.
Page 56 of 60