Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
2
2
2
1
Contributors
3
2
2
Categories
3
3
2
2
2
Platforms
5
3
Products / Services
5
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects modifications to Microsoft Defender antivirus exclusions. Adversaries often add paths or files to the exclusion list to prevent the detection of malicious tools or staging folders during cyberattacks. The rule monitors both command-line execution of PowerShell (Add-MpPreference/Set-MpPreference) and direct registry modifications related to Windows Defender paths.
Detects the use of PowerShell commands 'Add-MpPreference' or 'Set-MpPreference' to add the entire C drive as an exclusion path for Windows Defender. This is a common technique used by attackers to disable security monitoring for the entire file system.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Detects addition of AV exclusion paths to hide malicious files from scanning
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Detects addition of AV exclusion paths to hide malicious files from scanning
This rule detects attempts to add an exclusion path to Windows Defender via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS) containing the strings "Exclusions\Paths" and "WindowsDefender" (case-insensitive). This activity could indicate an attacker trying to disable or bypass antivirus protection.