Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
112 detections
Filters
Last updated
All Time
Detection languages
65
19
18
3
2
Contributors
33
26
17
8
7
Categories
38
29
26
18
11
Platforms
108
1
Products / Services
41
25
12
10
10
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Detects the use of appcmd.exe to disable HTTP logging for an IIS site by setting 'dontLog' to True. Adversaries may perform this action to evade detection and prevent security logging of their activities on a compromised web server.
This rule detects activities associated with post-exploitation cleanup and defense evasion on Windows systems. It identifies the clearing of Security and System event logs using 'wevtutil.exe' or PowerShell, as well as the modification of audit policies using 'auditpol.exe' to potentially disable logging or auditing capabilities.
Detects the use of the IIS command-line utility (appcmd.exe) to disable HTTP logging for an IIS site. Attackers may disable logging to conceal post-exploitation activities or unauthorized access attempts from forensic analysis and security monitoring.
Detects modifications to Windows domain trusts (Event ID 4706) or changes to domain security policies (Event ID 4716). These events are critical as they can indicate attempts to modify domain-level trust relationships or alter auditing and security settings.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
This rule detects the potential tampering of IIS logging configurations within a short duration following suspected web shell activity. It monitors for the execution of appcmd.exe or PowerShell commands that disable or modify IIS logging, specifically targeting sites or configurations after an IIS worker process (w3wp.exe) has performed activity associated with a webshell. This pattern is indicative of an attacker attempting to conceal their footprint after gaining access.
This rule detects activities associated with the StrikeShark SharkLoader malware, specifically its attempts to suppress Event Tracing for Windows (ETW) and tamper with event logs. It identifies the use of 'wevtutil.exe' to clear security logs, 'auditpol.exe' to disable audit categories, the loading of specific DLLs ('SyncRes.dat', 'DscCoreR.mui', 'SystemSettings.dll') from suspicious AppData paths, and processes originating from these suspicious AppData paths spawning 'wevtutil.exe' or 'auditpol.exe'.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
Detects modifications to Windows domain trusts (Event ID 4706) or changes to domain security policies (Event ID 4716). These events are critical as they can indicate attempts to modify domain-level trust relationships or alter auditing and security settings.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
Detects modifications to the Windows Update registry keys that disable automatic updates. Attackers may perform this action to prevent the installation of security patches and maintain vulnerabilities on a compromised system.
Detects attempts to stop or clear Windows Event Logs using command-line utilities such as 'sc', 'net', or 'wevtutil'. This activity is often performed by adversaries to remove forensic evidence of their actions.
Detects collection of event log size, retention, record count, and audit policy categories to understand defensive visibility. This rule specifically looks for the execution of 'powershell.exe' with 'Get-WinEvent -ListLog Security' or 'auditpol.exe' with '/get /category' command-line arguments.
Detects disabling of Windows Event Log service
Detects the execution of 'netsh.exe', 'sc.exe', or 'powershell.exe' with command-line arguments indicative of enabling network discovery, file and printer sharing, or modifying firewall rules to allow inbound connections. This behavior is associated with the Gentlemen ransomware for propagation.
This rule detects attempts to remotely disable the Windows Event Log service over SMB (port 445). It specifically looks for TCP traffic to port 445 on the home network, containing the case-insensitive strings "EventLog" and "StopService". This activity is indicative of an attacker trying to hinder forensic analysis or evade detection by stopping logging services.
Page 1 of 6