Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects attempts to disable security tools on Linux systems. Specifically, it looks for command-line invocations of `iptables`, `ip6tables`, `firewalld`, `cbdaemon` (Carbon Black), `falcon-sensor` (CrowdStrike), and `setenforce` (SELinux) with arguments indicating a stop or disable action. This activity is often associated with adversaries attempting to impair defenses to facilitate further malicious actions.
Detects suspicious changes to Windows Defender's configuration settings, which could indicate an attempt to disable or impair its protective capabilities. This rule specifically looks for modifications to registry keys related to disabling anti-spyware, removable drive scanning, network drive scanning, cloud-delivered protection (Block at First Seen), and real-time protection reporting.
This rule detects attempts to uninstall the Crowdstrike Falcon sensor by monitoring process creation events for specific command-line arguments. It looks for the execution of 'WindowsSensor.exe' with the '/uninstall' and '/quiet' flags, which are indicative of a silent uninstallation process. Adversaries often disable security tools like EDRs to evade detection of their malicious activities.
This rule detects when the Windows Defender operational event log is disabled by setting its 'Enabled' registry value to 0. This activity has been observed in relation to Lockbit 3.0 ransomware infections as a defense evasion technique.
Detects when an IP set is created in AWS GuardDuty. This activity could indicate an adversary attempting to whitelist their malicious IP addresses to avoid detection by GuardDuty, thereby disabling security alerts against their activities.
Detects when the 'Windows Defender Threat Protection' service is disabled or stopped. This event is triggered when the service state changes to stopped, which could indicate an attempt to impair defenses.
This rule detects when exclusions are added to Windows Defender. Adversaries often add exclusions to security software to prevent their malicious tools and activities from being detected. This specific rule looks for Event ID 5007, which indicates a change in the antimalware platform configuration, and checks if the new configuration value contains the string '\Microsoft\Windows Defender\Exclusions'. This indicates that a path or file has been added to Windows Defender's exclusion list.
Detects the execution of the "logman" utility to disable or delete Windows trace sessions, which can be used by adversaries for defense evasion by tampering with logging mechanisms like Sysmon or other kernel loggers.
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (Kernel Driver Utility) or Ghost-In-The-Logs, which uses KDU. This activity can indicate an attempt to load a malicious driver for defense evasion or other purposes.
Detects when the grace period for Windows Defender expires, indicating that protection against viruses, spyware, and other potentially unwanted software is disabled. This event suggests a critical security control has been impaired.
Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
Detects when the Windows Defender feature for scanning malware and potentially unwanted software is disabled. This is indicated by Event ID 5010 from the WinDefend service.
Detects when the Windows Defender antivirus scanning feature is disabled, indicated by Event ID 5012 from the WinDefend service. This action is often performed by adversaries to impair defenses and avoid detection.
Detects attempts to uninstall or terminate security products using the Windows Management Instrumentation Command-line (WMIC) utility. Adversaries often disable or remove security software to evade detection and facilitate their malicious activities. This rule specifically looks for WMIC commands that target common security product names and attempt to uninstall or terminate them.
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Detects attempts to disable or modify Microsoft Defender features using PowerShell commands, specifically targeting various scanning and monitoring capabilities. The rule looks for `Add-MpPreference` or `Set-MpPreference` cmdlets combined with parameters like `DisableArchiveScanning`, `DisableRealtimeMonitoring`, `DisableIOAVProtection`, `DisableBehaviorMonitoring`, `DisableBlockAtFirstSeen`, `DisableCatchupFullScan`, or `DisableCatchupQuickScan` set to `$true` or `1`. It also includes detection for base64 encoded versions of these commands.
Detects the usage of "reg.exe" to add Windows Defender folder exclusions. This technique has been observed being used by QakBot (formerly Qbot) to add exclusions for folders within AppData and ProgramData, aiming to evade detection by the antivirus software.
Detects attempts to disable Windows Defender Tamper Protection by modifying the relevant registry key. Tamper Protection is a security feature that prevents malicious programs from changing important security settings.
This rule detects error messages generated by Sysmon when it fails to open its service configuration or connect to its driver to update the configuration. These errors can indicate an adversary's attempt to tamper with or disable Sysmon logging to evade detection. The rule specifically filters out known false positives related to write-protected media or specific error codes (19, 93) to reduce noise.
Detects when an attacker attempts to disable or modify Sysmon's configuration to evade detection. This rule specifically looks for Sysmon's state changing to 'Stopped' or a 'Sysmon config state changed' event occurring when Sysmon was not already in a 'Started' state.
Page 57 of 60