Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
This rule identifies known malicious components associated with TriBack Loader by monitoring for exact cryptographic MD5 hash matches of three specific DLL files: hostfxr.dll, avk.dll, and MpClient.dll. By using exact hash matching, the rule minimizes the risk of false positives that might arise from filename-based detection of legitimate system binaries.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects TOKYOCORE ransomware via high-confidence identity strings; a single match is sufficient
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects TOKYOCORE via overlap of data-theft artifact strings and persistence-mechanism strings (Tier 4 cluster)
Detects AzureCommunication.dll C2 communication module by embedded strings or known hashes
Detects the use of PowerShell to execute the 'Set-MpPreference' command with the 'DisableRealtimeMonitoring' parameter set to true. This technique is commonly used by adversaries to impair Windows Defender security controls and avoid detection during the post-compromise phase.
Detects files containing 3+ TOKYOCORE ransom note strings combined with 2+ C2-related strings (Tier 2 cluster overlap)
YARA signature for the MSI installer's spoofed property data impersonating a legitimate Windows update package, requiring both the spoofed filename and an MSI-internal structural artifact
Detects when the Tamper Protection feature of Windows Defender is disabled. This action is often taken by adversaries or malicious software to weaken endpoint defenses and facilitate further compromise or concealment of malicious activity.
Detects modifications to Windows Defender exclusion settings by monitoring both PowerShell command lines containing 'Set-MpPreference' with 'ExclusionPath' and direct Registry modifications to the Defender exclusions key. Threat actors commonly use these techniques to bypass security scanning for malicious files or tools placed in the 'C:\ProgramData' directory.
Detects NirSoft-based credential harvesting toolkit binaries staged in user profile path csidl_profile\music\mimik\pass\, used to extract browser, VNC, email, Wi-Fi, and Credential Manager secrets
Detects unauthorized attempts to modify Microsoft Defender Tamper Protection registry keys. The rule correlates registry value changes from '5' (Enabled) to '0' or '4' (Disabled) against Microsoft Defender Antivirus Troubleshooting Mode events to distinguish between legitimate administrative troubleshooting and potentially suspicious local tampering.
Detects execution/staging of the GodDamn ransomware encrypter binary encrypter-windows-gui-x86.exe from user profile Downloads or Music folders, or matching the known encrypter hash
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
Detects known WinUpdateHelper.dll malicious variants by SHA256 hash, side-loaded to initiate infection across 17 kill chains
Detects dropped builder/README/config files from underground Ransomware-as-a-Service kits bundling FUD AES-256 crypters, private stubs, decrypters, and key generators for Windows 10/11 ransomware payloads
This rule detects the presence of the GodDamn ransomware encryptor on a host by identifying the specific binary filename (encrypter-windows-gui-x86.exe), its known SHA256 hash, or the presence of the .God8Damn file extension commonly associated with files encrypted by this malware.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
Detects attempts to tamper with Windows security services and configurations. The rule identifies PowerShell commands used to add Windows Defender exclusions or disable real-time protection, as well as command-line utilities like sc.exe and net.exe used to stop security, antivirus, or EDR services. This behavior is indicative of defense evasion.
Page 17 of 43