Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
24
16
5
4
1
Contributors
11
9
8
4
4
Categories
14
11
9
8
6
Platforms
40
6
6
1
1
Products / Services
17
9
9
7
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects attempts to suppress PowerShell ETW telemetry by modifying the PSEtwLog object (setting it to null or 0) in conjunction with indications that AMSI initialization has failed, suggesting a coordinated effort to blind security monitoring during malicious script execution.
Detects artifacts associated with the SharkLoader malware, specifically the dropping of suspicious .dat and .mui files in AppData staging directories (e.g., xwreg, xgdf) and the subsequent loading of these files as executable modules. This behavior is indicative of MinHook or Detours-based API hooking used for EDR evasion.
Detects memory patching operations targeting 'ntdll.dll', specifically aiming to disable ETW (Event Tracing for Windows) by modifying 'EtwEventWrite' or 'NtTraceEvent' functions. This activity is filtered to detect processes originating from PyInstaller-compiled binaries, identified by the use of '_MEI' temporary extraction directories or specific process names like 'winupdate.exe', which are commonly associated with malicious use of the PyInstaller framework.
Detects the creation of specific file artifacts associated with the VILE ransomware. The VILE ransomware Go-based binary is known for employing ETW tracing suppression and direct NT system calls to bypass EDR user-mode hooking. Identifying these unique filenames on the host acts as a high-fidelity indicator that the VILE binary is actively present and executing.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
This rule detects activities associated with the StrikeShark SharkLoader malware, specifically its attempts to suppress Event Tracing for Windows (ETW) and tamper with event logs. It identifies the use of 'wevtutil.exe' to clear security logs, 'auditpol.exe' to disable audit categories, the loading of specific DLLs ('SyncRes.dat', 'DscCoreR.mui', 'SystemSettings.dll') from suspicious AppData paths, and processes originating from these suspicious AppData paths spawning 'wevtutil.exe' or 'auditpol.exe'.
Detects the loading of known hooking libraries (MinHook or Microsoft Detours) or SharkLoader-specific components (SyncRes.dat) into non-system processes, followed by the staging of payload components in user directories. This behavior is indicative of malware attempting to intercept critical system APIs (such as VirtualAlloc and Sleep) to evade memory scanning and analysis by EDR solutions.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
Detects modifications to Windows Registry keys associated with Event Tracing for Windows (ETW) Autologger configurations or Event Log service configurations. These modifications can be used by adversaries to disable or tamper with event logging mechanisms, effectively blinding security telemetry and evading detection.
Detects indicators of VILE ransomware activity, specifically identifying attempts to suppress Event Tracing for Windows (ETW) via NtTraceEvent patching, alongside execution of low-level NT syscalls and the presence of identified VILE-associated artifact files (e.g., .ico, .zip, .json).
Detects LCRYX ransomware modifying registry keys to impair analyst interaction. It specifically monitors for the creation of the Scancode Map registry key, used to disable keyboard input, and the modification of the SwapMouseButtons registry key, used to invert mouse button functionality.
This rule detects attempts to create symbolic links, junctions, or reparse points that target Microsoft Defender directories such as quarantine, platform, or scan paths. Adversaries may use these techniques to interfere with security tools, evade detection, or manipulate how Defender processes files.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
This rule detects network traffic on TCP port 445 (SMB) containing the string "DisableRealtimeMonitoring" (case-insensitive). This string is often associated with attempts to disable real-time monitoring features of security products, typically by modifying registry keys. The detection is focused on traffic flowing from any source to the home network, specifically to the SMB port, and only on established connections. This activity is indicative of an attacker attempting to evade detection by crippling security software.
Detects potential Event Tracing for Windows tampering through suspicious access to ntdll.dll memory regions, a technique used by Qilin ransomware to suppress telemetry
Detects attempts to disable or stop syslog services (syslog, rsyslog, syslog-ng) using common system utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses by preventing logging of their actions.
Detects PowerShell scripts using .NET Reflection to modify internal fields to disable Event Tracing for Windows (ETW) or the Anti-Malware Scan Interface (AMSI). This technique is used by malware like the MIMICRAT loader to evade defenses before executing its main payload.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Detects an adversary stopping or killing the syslog daemon (syslog,
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
Detects when an Okta user session starts from an IP address associated with an anonymizing proxy service. This could indicate an attempt to bypass security controls or obscure the true origin of the access.
Page 1 of 3