Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
746 detections
Filters
Last updated
All Time
Detection languages
368
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
297
143
135
93
Platforms
648
48
24
21
15
Products / Services
189
177
145
133
132
MITRE Techniques
18,098
15,553
12,544
8,358
6,159
746
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Detects suspicious changes to the Windows Defender configuration
Detects registry modifications that disable Privacy Settings Experience
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detects the Setting of Windows Defender Exclusions
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Yara rule that detects ShadowCryptor ransomware.
Yara rule that detects Clop ransomware.
Page 36 of 36