Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects potential post-exploitation activity on Linux systems where a web application process (e.g., Python-based servers like uvicorn or gunicorn) initiates network requests using curl or wget, followed within 30 minutes by attempts to disable the system firewall or terminate security monitoring agents.
Detects the modification of Windows Defender exclusion settings using the Add-MpPreference or Set-MpPreference PowerShell cmdlets. Adversaries often abuse these cmdlets to add malicious files or directories to the exclusion list, allowing them to evade antivirus detection.
Detects modifications to Windows Defender registry keys responsible for defining file, path, process, or extension exclusions. Adversaries often modify these settings to prevent security software from scanning their malicious artifacts.
This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe).
Detects the execution of the 'csrutil status' command, which is used to check the status of System Integrity Protection (SIP) on macOS. This query specifically looks for this command being executed by 'osascript' or 'Script Editor', which are common methods used to automate or hide the command execution.
This rule detects attempts to evade Windows Defender by adding exclusion paths or processes using PowerShell's Add-MpPreference cmdlet. Specifically, it looks for commands that attempt to exclude 'C:\' or 'powershell.exe', a technique known to be leveraged by AsyncRAT.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 by leveraging the JIT heap to patch internal AmsiUtils methods or manipulate System.Management.Automation AMSI fields.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
Detects the successful deletion of Azure Resource Locks. Resource locks are a primary defense against unintended modification or deletion of Azure resources. Removing them can indicate potential malicious intent or defense evasion tactics prior to executing ransomware or destroying critical resources.
Detects the use of the appcmd.exe utility to disable IIS HTTP logging by setting the 'dontLog' configuration attribute to 'True'. This behavior is commonly used by attackers to hide malicious activity, such as webshell POST requests, from being captured in IIS logs.
Detects the successful deletion of diagnostic settings in Azure, which may be an attempt by an adversary to impair logging and hide malicious activity.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for the loading of amsi.dll in suspicious processes, combined with behavioral indicators such as execution from user-writable paths, child process creation, or outbound network connections, and the presence of strings associated with common AMSI bypass techniques.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
Detects the deletion of immutability policies on Azure blob containers. Immutability policies protect critical data from being tampered with; their deletion is a necessary step for attackers aiming to encrypt or destroy backups and storage data prior to a ransomware event.
Page 8 of 60