Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects execution of potential BeepRAT loaders such as tcc.exe, luajit.exe, or hfy.exe that exhibit evasive behavior by loading amsi.dll. This activity is indicative of in-memory shellcode execution attempting to disable security features like AMSI, ETW, or WLDP before loading malicious payloads.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects the installation of a driver service using sc.exe from suspicious, non-standard directories (e.g., Temp, AppData) or involving common driver extensions (.sys). This behavior is indicative of the Bring Your Own Vulnerable Driver (BYOVD) technique, often used to load vulnerable drivers to bypass or disable security products, consistent with activities attributed to various threat actors.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
This rule detects PowerShell command lines that contain indicators associated with AMSI (Antimalware Scan Interface) bypass techniques and low-level memory manipulation methods, such as 'VirtualProtect' and 'GetFunctionPointer' used in conjunction with 'RuntimeHelpers'. These techniques are commonly used by attackers to subvert defensive security mechanisms and execute malicious code in memory.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by patching the AMSI context in memory. The rule identifies the combination of using VirtualProtect via P/Invoke to modify memory protections, followed by using Marshal.WriteInt64 to overwrite the pAppName field in the AmsiContext structure. This technique is commonly used by obfuscated PowerShell scripts to evade signature-based detection.
This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.
Detects the use of .NET reflection within PowerShell to access the 'AmsiUtils' class and set the 'amsiInitFailed' field to true. This technique effectively disables the Antimalware Scan Interface (AMSI) for the current PowerShell process, allowing subsequent malicious code or scripts to execute without being scanned for threats.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell script via PowerShell, typically executed via IEX (Invoke-Expression) to load the payload directly into memory, which is a common post-exploitation technique often performed following an AMSI bypass.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
Detects modifications to the Windows registry key 'DisableTaskMgr' within the 'Policies\System' hive. Adversaries, including the TrymeLocker malware, may perform this action to prevent users from terminating malicious processes using the Task Manager.
This rule detects modifications to critical Windows registry keys associated with disabling security features (Microsoft Defender, WDigest credential storage) or establishing persistence via Image File Execution Options (IFEO). These modifications are often performed by adversaries to impair defensive monitoring, bypass credential protections, or execute malicious code when specific processes start.
Detects the execution of commands to disable Microsoft Defender (specifically Set-MpPreference or stopping the WinDefend service) within 10 minutes of the first interactive user login on a host. This behavior is indicative of threat actors, such as Akira ransomware affiliates, performing anti-forensics and disabling security controls on newly provisioned or compromised systems.
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by executing PowerShell commands that manipulate memory structures directly. Specifically, it looks for the use of the Marshal.WriteInt64 method to nullify the pAppName pointer at offset 0x08 within the AMSI_CONTEXT_INTERNAL structure, a known technique to disable AMSI scanning for the current process.
Detects anomalous loading of amsi.dll by processes running from suspicious staging paths commonly associated with the Yuta/Glove Stealer campaign. The rule identifies processes that may be performing in-memory patching of 'AmsiOpenSession' or 'EtwEventWrite' to blind security telemetry, a hallmark of credential theft malware.
Detects modifications to Windows boot configuration or registry settings to enable 'testsigning' mode. Enabling testsigning allows for the loading of unsigned drivers or software into the kernel, which is a common technique used by attackers to bypass driver signature enforcement for rootkit or malicious driver deployment.
Detects malicious registry modifications performed via 'reg.exe', 'regedit.exe', or PowerShell that indicate attempts to establish persistence through Run keys and service creation, or to impair security defenses by disabling features such as Windows Defender's AntiSpyware and RealtimeMonitoring, as associated with the GOLD ENCOUNTER, STAC4713, and STAC3725 campaigns.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects file creation, modification, or renaming events affecting the 'config.db' file within the Microsoft Desktop App Installer package directory. This file is used by the AppInstaller process and unauthorized modification may indicate attempts to tamper with installed applications or app installation settings.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Page 6 of 60