Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
44 detections
Filters
Last updated
All Time
Detection languages
28
10
3
2
1
Contributors
26
6
5
3
2
Categories
15
9
7
7
6
Platforms
42
Products / Services
20
15
13
7
6
MITRE Techniques
18,079
15,542
12,519
8,344
6,154
Detects the creation of new files with the ".evtx" extension in non-common or non-standard location.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.
The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
The following analytic detects suspicious modifications to the EventLog security descriptor registry value for defense evasion. It leverages data from the Endpoint.Registry data model, focusing on changes to the "CustomSD" value within the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\<Channel>\CustomSD" path. This activity is significant as changes to the access permissions of the event log could blind security products and help attackers evade defenses. If confirmed malicious, this could allow attackers to block users and security products from viewing, ingesting and interacting event logs.
The following analytic detects the execution of "wevtutil.exe" with parameters to disable event logs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because disabling event logs is a common tactic used by ransomware to evade detection and hinder forensic investigations. If confirmed malicious, this action could allow attackers to operate undetected, making it difficult to trace their activities and respond effectively to the incident.
Detects the modification of Microsoft IIS configuration to disable HTTP logging using the appcmd.exe utility. This technique is often used by adversaries to impair security monitoring and evade detection after compromising a web server.
Detects attempts by an adversary to disable or clear Windows Event logs using standard administrative utilities such as wevtutil, PowerShell, auditpol, net, sc, or wmic to cover tracks or hinder forensic analysis.
Detects the use of the wevtutil.exe utility to clear the Microsoft-Windows-Defender/Operational event log, a technique used by adversaries to disrupt security monitoring and hide malicious activity.
Detects attempts to terminate or delete security-related services and logging agents, such as Sysmon, Filebeat, and various endpoint protection agents, using legitimate Windows system utilities like taskkill, sc, or wmic.
Detects the use of the wevtutil.exe utility to clear the Microsoft-Windows-Defender/Operational event log, a technique used by adversaries to disrupt security monitoring and hide malicious activity.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential tampering with Windows Event Logs or audit services by correlating manual service stops or log clearing events (EventIDs 1100, 1102, 104, 7036, 7040) with a sudden, significant decrease in total event volume on the same host. The rule accounts for planned maintenance and legitimate event log service restarts to reduce noise.
Detects potential abuse of Microsoft Defender’s BTR boot-time remediation driver by correlating known driver loads with BootClean.log activity, unexpected loader processes, and driver execution outside normal Defender paths.
This rule detects mass disabling of Windows Event Log channels by monitoring registry value modifications where multiple 'Enabled' values are set to '0' within a short timeframe. This behavior is indicative of anti-forensics activity where an adversary attempts to suppress specific log sources to evade detection.
This rule detects mass disabling of Windows Event Log channels by monitoring registry value modifications where multiple 'Enabled' values are set to '0' within a short timeframe. This behavior is indicative of anti-forensics activity where an adversary attempts to suppress specific log sources to evade detection.
Threat actors, particularly ransomware operators, are known to attept to disable EDR tooling prior to completing their actions on objectives in order to better carry our their actions uninhibited. Ransomware groups such as The Gentlemen have been observed using PowerShell to disable Microsoft Defender real time protection.
* Note if you are standardized on MITRE ATT&CK v19, this is now tracked as T1685.001
* Note if you are standardized on MITRE ATT&CK v19, this is now tracked as T1685.001
Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
This technique were seen used by threat actors and ransomware strains in order to evade defenses.
Page 1 of 3