Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects WordlistLoader binaries containing the decode-and-execute routine that reconstructs shellcode via a wordlist mapping or UUID string array, then marks it RWX before invoking the entry point
Detects the addition of a Microsoft Defender exclusion path targeting suspicious directories or executables that mimic legitimate Windows Defender installation paths (e.g., 'Microsoft\Windows Defender' or 'defender.exe'). This behavior is indicative of defense evasion, allowing attackers to hide malicious files from real-time scanning by bypassing security controls via PowerShell Set-MpPreference or WMIC.
Detects Amatera Stealer shellcode anti-emulation patching stub using cff_state control-flow flattening and inplace_xor_decrypt reflective loader routine
Detects BeaverTail malware deployed via PurpleDelta/PurpleBravo coordination; requires multiple occurrences of the distinctive BeaverTail string to reduce false positives
This rule detects instances where the Windows Defender Antivirus service (MsMpEng.exe) spawns common command-line shells (cmd.exe, powershell.exe, conhost.exe) while running under the SYSTEM context. This behavior is highly irregular for a security product and is indicative of process injection, exploit payload execution, or anti-tampering bypass attempts.
Detects the presence of the msaRAT MSI dropper (update_ms.msi) and its associated embedded payload (lib.dll), identified by the 'RUN' export and specific msa* string bindings used for inter-process communication or internal functionality.
Detects vssvc.exe opening a handle to MsMpEng.exe.
In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
This handle acquisition is observed at the exact moment of exploitation.
vssvc querying MsMpEng is not expected in normal operation.
In the RedSun exploit, VSS participates in the cloud-file restore race that directs WD to write through the NTFS junction.
This handle acquisition is observed at the exact moment of exploitation.
vssvc querying MsMpEng is not expected in normal operation.
This rule detects instances where the Windows Defender Antivirus service (MsMpEng.exe) spawns common command-line shells (cmd.exe, powershell.exe, conhost.exe) while running under the SYSTEM context. This behavior is highly irregular for a security product and is indicative of process injection, exploit payload execution, or anti-tampering bypass attempts.
This rule detects potential Bumblebee loader activity by identifying files named 'msimg32.dll' that possess specific known builder file versions and exhibit anomalous, dictionary-derived 'gibberish' entries within their PE version information metadata fields (Comments, CompanyName, or FileDescription).
The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\).
It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity.
In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32.
If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity.
In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32.
If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
This rule detects instances where the Windows Defender Antivirus service (MsMpEng.exe) spawns common command-line shells (cmd.exe, powershell.exe, conhost.exe) while running under the SYSTEM context. This behavior is highly irregular for a security product and is indicative of process injection, exploit payload execution, or anti-tampering bypass attempts.
Detects Windows Defender engine (mpengine.dll) or signature database files (*.vdm) being created by any process that is not a Windows Defender component.
BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation.
BlueHammer extracts these files from the downloaded mpam-fe update package into a UUID-named subdirectory of %TEMP% as part of staging the TOCTOU privilege escalation.
This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.
This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.
This rule detects when Microsoft Defender SmartScreen identifies and blocks or warns users about access to known 'ClickFix' phishing landing pages. These pages often attempt to social engineer users into executing malicious commands via copy-paste actions (e.g., in a terminal or Run dialog) as a deceptive remediation step for fake browser errors.
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects known CornFlake and ChocoShell malware binaries by exact full SHA-256 hash of executable files (file-write/process-creation scope), not incidental hash string mentions
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects TOKYOCORE ransomware artifacts referencing the fsociety.exe binary being dropped to Downloads and copied to System32, alongside the WindowsUpdate.exe persistence copy
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Page 16 of 43