Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
This rule detects attempts to disable Windows Defender's security monitoring features using PowerShell or the 'sc.exe' utility. Specifically, it looks for PowerShell commands that include '-DisableBehaviorMonitoring $true' or '-DisableRuntimeMonitoring $true'. It also identifies 'sc.exe' commands used to stop, delete, or disable the 'WinDefend' service (Windows Defender Antivirus Service). This activity is indicative of an adversary trying to impair defenses to avoid detection.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
Detects the use of the 'sc.exe' utility to change the startup type of a Windows service to 'disabled' or 'demand'. This action can be used by adversaries to impair defenses or prevent legitimate services from starting.
This rule detects attempts to hijack the Antimalware Scan Interface (AMSI) COM server by modifying a specific registry key. Adversaries can change the default value of the `InProcServer32` key for the AMSI CLSID (`{fdb00e52-a214-4aa1-8fba-4357bb0072ec}`) to point to a non-existent COM server. This action prevents AMSI from loading its COM component, effectively disabling its scanning functionalities and rendering it useless for malware detection.
Detects modifications to the Windows Registry that disable the Privacy Settings Experience. This can be an attempt by an adversary to impair defenses or hide their activities by preventing privacy-related notifications or settings from appearing.
This rule detects attempts to disable Windows Defender's Potentially Unwanted Application (PUA) protection by monitoring changes to the 'PUAProtection' registry key. Specifically, it triggers when the 'PUAProtection' value is set to '0x00000000' (DWORD 0), indicating that PUA protection has been disabled.
Detects the modification of the 'TurnOffCheck' registry value to '1' (0x00000001) within the 'ScriptedDiagnostics' key. This action can be used to bypass defenses related to the Microsoft Support Diagnostic Tool (MSDT) Follina vulnerability, as setting this value to 1 disables checks for scripted diagnostics. An attacker might enable this to execute malicious code via MSDT without user interaction or security warnings.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry keys. Adversaries might do this to lower the default file type risk, allowing potentially malicious files (like executables, scripts, or archives) to bypass security warnings when downloaded or opened. The rule specifically looks for modifications to 'DefaultFileTypeRisk' to a value that indicates low risk (0x00006152) or additions of common executable/script file extensions to 'LowRiskFileTypes'.
This rule detects when an application or user re-enables older, less secure TLS versions (TLS 1.0 or TLS 1.1) by setting the 'Enabled' registry value to '1' under the 'Protocols' key in the Windows registry. This action can weaken the system's security posture by allowing communication over deprecated protocols.
This rule detects the execution of the PowerShell cmdlet `Disable-WindowsOptionalFeature` with specific parameters, indicating an attempt to disable Windows optional features. The rule specifically looks for the `-Online` and `-FeatureName` parameters, and then checks for common Windows Defender related feature names. This activity could be part of an adversary's defense evasion tactics to impair security tools.
Detects base64 encoded PowerShell commands that use 'Add-MpPreference' or 'Set-MpPreference' cmdlets to modify or tamper with Windows Defender Antivirus settings. This is a common technique used by adversaries to disable or reduce the effectiveness of endpoint security solutions.
This rule detects the execution of Symantec CleanWipe, a utility designed to remove Symantec antivirus products. Adversaries may use such tools to disable security software as part of their defense evasion tactics. The rule identifies CleanWipe by specific executable names and command-line arguments associated with its uninstallation functions.
Detects applications being added to the "allowed applications" list of Exploit Guard's Controlled Folder Access feature, specifically when these applications are located in suspicious paths. This action can be used by adversaries to bypass Controlled Folder Access protections and execute malicious code.
Detects the installation of 'NalDrv' or 'PROCEXP152' services by monitoring registry key modifications. These services are associated with the 'Ghost-In-The-Logs' tool, which leverages KDU for defense evasion. The rule specifically looks for the creation of these service ImagePath registry values in non-system32 folders, filtering out legitimate instances of tools like procexp and procmon.
This rule detects attempts to tamper with Windows Attachment Manager settings by modifying specific registry values. These modifications can disable security features related to file attachments, such as hiding zone information, preventing the saving of zone information, or disabling antivirus scanning for downloaded files. Such actions are often performed by adversaries to evade detection and facilitate the execution of malicious files.
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Detects registry modifications that disable Privacy Settings Experience
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Page 59 of 60