Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
746 detections
Filters
Last updated
All Time
Detection languages
368
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
297
143
135
93
Platforms
648
48
24
21
15
Products / Services
189
177
145
133
132
MITRE Techniques
18,098
15,553
12,544
8,358
6,159
746
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects coordinated EDR-blinding techniques where a process performs in-memory patching of AMSI (AmsiScanBuffer) or ETW (EtwEventWrite) while simultaneously executing direct syscalls to bypass standard ntdll.dll hooked exports. This combination is highly indicative of malicious activity attempting to evade endpoint security instrumentation.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects instances where the TOKYOCORE malware (fsociety.exe) attempts to identify or enumerate the presence of security-critical applications, including debuggers, virtual machine guest agents, and antivirus/EDR software. This behavior is indicative of malware attempting to evade analysis or disable security controls.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the disabling of User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. Adversaries may disable UAC to bypass elevation prompts and facilitate unauthorized modifications to the operating system.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects unauthorized processes (non-msiexec.exe) modifying registry keys related to TempPackages alongside simultaneous modification or interaction with .rbs or .rbf files located within the C:\Config.Msi directory. This behavior is indicative of potential MSI installer hijacking or tampering attempts where an adversary attempts to bypass standard installer execution paths.
Detects the loading of known TELEPUZ-specific DLLs into common Windows host processes (rundll32.exe and svchost.exe). TELEPUZ is known to perform ETW (Event Tracing for Windows) tampering by patching ntdll.dll functions during initialization, which is a technique used to suppress security telemetry.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects the use of the bindutil.exe utility with the --link argument to redirect or interact with amsi.dll. This behavior is indicative of an attempt to bypass or interfere with the Antimalware Scan Interface (AMSI) in Windows, potentially allowing for the execution of malicious scripts or code without detection. The rule includes filters for legitimate processes typically associated with virtualized or containerized environments.
Detects modifications to the Windows Registry key 'DisableTaskmgr' within the 'Policies\System' path, which is used to disable the Task Manager. This is a common tactic used by malicious actors to prevent users from monitoring or terminating malicious processes.
Detects instances where a 'node.exe' process spawns common reconnaissance utilities (tasklist.exe, wmic.exe, sc.exe) or attempts to access registry keys associated with security software (e.g., CrowdStrike, SentinelOne, Windows Defender). This behavior is indicative of a Node.js-based application potentially being leveraged as a platform for post-exploitation activities, such as environment discovery or tampering with security controls.
Detects the loading of amsi.dll by rundll32.exe when invoked with specific command-line arguments. This pattern is associated with the TELEPUZ malware, which leverages this technique to patch the AmsiScanBuffer function in memory, effectively disabling AMSI (Antimalware Scan Interface) scanning for the process.
Page 28 of 36