Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects attempts to remove Windows Defender definition files using the MpCmdRun.exe utility with the '-RemoveDefinitions -All' command-line arguments. This action is typically performed by adversaries to disable or impair Windows Defender's ability to detect malicious software, thereby facilitating their activities and avoiding detection.
This rule detects attempts to bypass Antimalware Scan Interface (AMSI) functionalities by using specific strings or NULL bits in command-line arguments. Adversaries often employ such techniques to obfuscate malicious scripts or commands, preventing security products from detecting and blocking them. The rule specifically looks for patterns like "if(0){{{0}}}' -f $(0 -as [char]) +" and "#<NULL>" in the command line, which are known indicators of AMSI bypass attempts.
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features such as IEHarden, Data Execution Prevention (DEP), and the First Run Customize wizard.
This rule detects modifications to Microsoft Office registry keys that disable the Protected View feature. Adversaries may disable Protected View to bypass security warnings and execute malicious code embedded in Office documents without user intervention. The rule specifically looks for changes to registry values that control Protected View for attachments, internet files, intranet files, and unsafe locations, setting them to a disabled state (DWORD 0x00000001) or enabling specific protected view settings (DWORD 0x00000000).
Detects modifications to the Windows Package Manager (winget) administrative settings within the registry. This includes changes that could enable local manifest installations or disable installer hash checks, which might be abused by adversaries for defense evasion or persistence.
This rule detects when the Sysmon configuration is changed. This event (EventID 16) is generated by Sysmon itself when its configuration is updated, which could be a legitimate administrative action to reconfigure Sysmon or an attempt by an adversary to manipulate its monitoring capabilities to evade detection.
This rule detects command-line activities indicative of the uninstallation of Raccine, a ransomware protection tool. It specifically looks for combinations of commands used to terminate Raccine processes, delete its registry entries, and remove its scheduled tasks. The detection logic covers `taskkill` commands targeting `RaccineSettings.exe`, `reg.exe delete` commands referencing "Raccine Tray", and `schtasks /DELETE` commands for "Raccine Rules Updater".
Detects modifications to Windows Defender exclusion registry keys, which adversaries may use to disable or bypass antivirus scanning for specific files or paths.
Detects code fragments commonly found in small and obfuscated PowerShell scripts designed to bypass Antimalware Scan Interface (AMSI). The rule specifically looks for the combination of '[Ref].Assembly.GetType', 'SetValue($null,$true)', and 'NonPublic,Static' within PowerShell script block text, which are indicative of reflection-based AMSI bypass techniques.
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
Detects the execution of the 'reg.exe' utility with the 'delete' flag targeting registry keys associated with Windows services. This activity is often performed by attackers to remove or disable security software services as a defense evasion tactic.
Detects the execution of 'reg.exe' to modify registry keys associated with various Windows security services, attempting to disable them. This includes services like Windows Defender components (MsMpSvc, WinDefend, WdBoot, WdFilter, WdNisDrv, WdNisSvc), SecurityHealthService, AppIDSvc, NisSrv, Sense, UsoSvc, wscsvc, and wuauserv, by setting their 'Start' value to '4' (disabled).
Detects commands that attempt to disable Volume Shadow Copy Service (VSS) diagnostic logging by setting the 'Disabled' flag. This activity is often associated with ransomware or other malware attempting to prevent recovery of encrypted files or to evade forensic analysis.
Detects attempts to tamper with the PowerShell execution policy by modifying registry keys via the command line. This technique is often used by adversaries to bypass script signing requirements, allowing the execution of unsigned or malicious PowerShell scripts.
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses. The rule specifically looks for the execution of 'pssuspend.exe' or 'pssuspend64.exe' with 'msmpeng.exe' in the command line, which is the executable for Microsoft Defender Antivirus.
Detects the use of the 'taskkill' command to terminate the 'ccSvcHst.exe' process, which is associated with Symantec Endpoint Protection. This action can disable the antivirus software due to an incorrect implementation of the protected service mechanism, allowing a SYSTEM user to kill the process and shut down the service.
Detects the removal of folders from the "ProtectedFolders" list within Windows Defender Exploit Guard's Controlled Folder Access feature. This action could indicate an attacker attempting to bypass security controls to launch an encryption process, manipulate data within a protected folder, or otherwise impair defenses.
Detects attempts to disable the runtime scanning of enabled macros in Microsoft Office by modifying the 'MacroRuntimeScanScope' registry key. This modification can be used by adversaries to bypass security features like AMSI (Antimalware Scan Interface) for VBA macros, allowing malicious macros to execute undetected.
Detects when Windows Defender Exploit Guard Network Protection is disabled by a registry modification. This action can be taken by an adversary to bypass security controls and facilitate malicious network activity.
Detects attempts to tamper with Sophos antivirus functionality by modifying specific registry keys related to Tamper Protection. This rule looks for changes to 'SAVEnabled', 'SEDEnabled', or 'Enabled' keys within Sophos Endpoint Defense or SAVService paths, specifically when the value is set to '0x00000000' (disabled).
Detects the use of specific strings or NULL bits within PowerShell scripts that are commonly employed to bypass Antimalware Scan Interface (AMSI) functionalities. This technique aims to prevent security products from inspecting malicious script content.
Page 58 of 60