Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects when multiple security agent processes are terminated on a single host. Monitoring for the simultaneous or rapid termination of security products like Windows Defender, Cylance, SentinelOne, or Falcon suggests an attempt to disable endpoint protections before further malicious activity.
This YARA rule detects the SugarWraith loader, a malware component identified by the presence of specific diagnostic strings, system enumeration artifacts, and indicators of persistence or configuration related to tunnel bypass tools like ngrok. It specifically targets Windows-based binaries that exhibit characteristics associated with the UNK_SweetSpector threat activity.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
This rule detects the use of PowerShell to modify Windows Defender preferences, specifically by adding exclusions for paths or processes. Attackers commonly use this technique to exclude malicious files, directories, or process names from antivirus scanning, thereby facilitating the execution and persistence of malware.
Detects attempts to disable or modify Microsoft Defender Antivirus security settings through PowerShell commands (Set-MpPreference/Add-MpPreference) or by modifying Windows Registry keys related to Defender exclusions. Attackers often use these techniques to bypass security controls and prevent detection of malicious files or processes.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects Microsoft Defender service (MsMpEng.exe) spawning common interactive or scripting processes (such as cmd.exe, powershell.exe, etc.) while running as SYSTEM. This behavior is highly irregular for an antivirus engine and is characteristic of exploit-based process hollowing or quarantine pipeline abuse, as observed in CVE-2026-50656.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
Detects the use of the schtasks utility to modify and disable scheduled tasks related to Microsoft Windows Defender, specifically the scheduled scan, cache maintenance, and verification tasks. This behavior is indicative of an attempt to impair security defenses on a Windows host.
This rule monitors for the execution of known software utilities often used by adversaries to disable security controls, remove system locks on files, or tamper with security configurations. Specifically, it flags the usage of IObit Unlocker, Gmer (a known rootkit/tampering tool), and Defender Control (used to disable Windows Defender).
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects attempts to disable or tamper with Microsoft Defender by terminating its processes, stopping its associated services, adding directory exclusions, or modifying registry keys used to control its behavior and security settings.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects the use of reg.exe to modify Windows Registry keys related to disabling or tampering with Windows Defender security settings, such as Real-time Monitoring, Tamper Protection, and various scanning features.
Detects attempts to disable Windows Defender real-time protection, behavior monitoring, or scan capabilities. This is achieved by monitoring for specific HKLM registry modifications under 'SOFTWARE\Policies\Microsoft\Windows Defender' or the execution of PowerShell cmdlets 'Set-MpPreference' and 'Add-MpPreference' with arguments designed to disable security features or add file/process exclusions, often observed during initial stages of ransomware attacks.
Detects the execution of unsigned binaries located in directories typically excluded from EDR/AV scanning, such as Windows Defender folders, security vendor installation directories, and quarantine locations. Attackers utilize these paths to bypass file-system monitoring and on-execute detection by taking advantage of pre-configured security exclusions.
Page 18 of 43