Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
746 detections
Filters
Last updated
All Time
Detection languages
368
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
297
143
135
93
Platforms
648
48
24
21
15
Products / Services
189
177
145
133
132
MITRE Techniques
18,098
15,558
12,550
8,359
6,159
746
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
The following analytic detects Windows Filtering Platform filters that are added and configured to block outbound traffic for known EDR and security agent processes.
Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name.
This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.
Tools such as EDRSilencer abuse WFP to disrupt outbound telemetry from EDR processes, which can bypass detections that only look for the tool process name.
This detection looks for WFP add events with a block action and EDR process names embedded in the hexdump-like Conditions field.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Detects the Rust rustls custom AcceptAll ServerCertVerifier pattern (all three verify methods returning success unconditionally) used by the proc-macro1 payload to bypass TLS certificate validation when fetching its remote payload.
This rule monitors for high-risk modifications to Zscaler security policies such as disabling SSL inspection or DLP engines, or deleting/modifying firewall and URL filtering rules. It also flags administrative logins from locations previously unseen for that user, which may indicate account compromise or unauthorized access.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects attempts to impair Windows Defender protection by modifying preferences via PowerShell (Set-MpPreference/Add-MpPreference), stopping the WinDefend service using sc.exe, or altering sensitive Windows Defender registry keys. This rule monitors process execution and registry modification events, excluding known legitimate management tools like Intune and SCCM.
Detects command-line activity indicative of attempts to disable, bypass, uninstall, or interfere with the Netskope security agent functionality on an endpoint.
Detects the addition of a Microsoft Defender exclusion path targeting suspicious directories or executables that mimic legitimate Windows Defender installation paths (e.g., 'Microsoft\Windows Defender' or 'defender.exe'). This behavior is indicative of defense evasion, allowing attackers to hide malicious files from real-time scanning by bypassing security controls via PowerShell Set-MpPreference or WMIC.
Identifies devices with missing or non-compliant Microsoft Defender security controls across Windows, Linux, and macOS endpoints.
The query reviews Microsoft Defender Vulnerability Management (TVM) secure configuration assessments and highlights devices where critical security capabilities are not functioning as expected, including:
Microsoft Defender Sensor
Sensor Data Collection
Defender Communications
Tamper Protection
Real-time Protection
PUA Protection
Cloud-delivered Protection
Security Definitions
Results are enriched with device exposure levels, machine groups, and sensor health status to assist security teams with remediation prioritization.
The query reviews Microsoft Defender Vulnerability Management (TVM) secure configuration assessments and highlights devices where critical security capabilities are not functioning as expected, including:
Microsoft Defender Sensor
Sensor Data Collection
Defender Communications
Tamper Protection
Real-time Protection
PUA Protection
Cloud-delivered Protection
Security Definitions
Results are enriched with device exposure levels, machine groups, and sensor health status to assist security teams with remediation prioritization.
Detects the execution of the Cortex XDR agent administration tool (Cytool) with the 'protect disable' command line argument. This indicates an attempt to manually disable the security agent's protective features on an endpoint, which is a common technique used by adversaries to impair security controls.
Detects the ACRStealer BYOVD driver's ungated IOCTL 0x2205c0 being sent to \\.\DCRCVDRV_U by a non-management process, correlated within 2 minutes with termination of a security/EDR process, indicating kernel-level defense evasion via the vulnerable driver.
Detects the BYOVD kill chain for the DCRCVDrv.sys driver: drop to C:\Windows\Temp\, DCRCVDRV_U/LEGACY_DCRCVDRV_U service installation, device open, and IOCTL 0x2205c0 invocation used to terminate security/EDR processes from kernel context.
KQL Query
Detects completed administrative actions within the Cortex management console that result in a pause of endpoint protection. This action reduces security coverage on the targeted host and requires validation to ensure it aligns with authorized maintenance, troubleshooting, or incident response activities.
Detects high-risk administrative actions within Netskope, including the deletion of security policies, modification of Data Loss Prevention (DLP) rules, disabling of threat protection features, or the creation of new API tokens and administrative accounts. The rule flags these activities as 'critical' or 'high' severity, particularly if they occur outside standard business hours.
Cortex Agent Exception Rule Created
Cortex XDR
Detects the creation of a new exception rule within the Cortex endpoint agent management configuration. Exception rules can be used to exclude specific files, processes, or behaviors from security prevention policies, potentially leading to a reduction in defensive coverage.
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Detects coordinated activity where a PowerShell process executes multiple distinct administrative utilities (such as wevtutil, vssadmin, wbadmin, or bcdedit) to perform destructive actions like clearing event logs, deleting shadow copies, or disabling system recovery settings. This rule uses correlation to identify sequences of at least three distinct commands and utilities, reducing false positives associated with single administrative tasks.
Detects administrative changes to Zscaler location templates that disable critical security enforcement settings, specifically Firewall Control, IPS Control, or Acceptable Use Policy (AUP) enforcement. Such modifications may indicate an attempt to weaken an organization's perimeter defense posture.
Page 25 of 36