Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects indicators of activity associated with 'RoguePlanet', including specific command-line strings, named pipes, process spawning behaviors related to Microsoft Defender (MsMpEng.exe), and suspicious staging patterns involving 'wermgr.exe' in temporary directories.
Detects various methods of disabling or tampering with Windows Defender protections, including modifying preferences via PowerShell (Set-MpPreference), stopping the WinDefend service via sc.exe, terminating the antivirus process via taskkill, or modifying Registry keys associated with Defender policies.
Detects the creation of specific staging directories prefixed with 'RP_' in user temporary directories, containing 'System32' or 'wdtest_temp' subdirectories. This pattern is characteristic of an NTFS junction swap exploitation technique used to target Windows Defender quarantine artifact placement as part of the CVE-2026-50656 vulnerability.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
IoT botnet malware family used for DDoS and proxy infrastructure
Detects attempts by malicious processes, specifically those associated with Millennium RAT or launching from suspicious user-writable directories (AppData, Temp, etc.), to disable or tamper with security controls. This includes modifying Windows Defender configurations, stopping security services, clearing event logs, modifying audit policies, and terminating security-related processes.
Detects activity associated with the RoguePlanet exploit, which involves creating EICAR content and NTFS Alternate Data Streams (ADS) within specific staging directories (wdtest_temp or RP_<UUID>). This behavior is intended to trigger Windows Defender scans and induce a TOCTOU race condition (CVE-2026-50656) by manipulating file operations near the wermgr.exe process.
Detects anomalous file creation or modification events in sensitive Windows System32 directories originating from the Microsoft Defender process (MsMpEng.exe). Additionally, it detects when MsMpEng.exe spawns interactive shells (e.g., cmd.exe, powershell.exe), which is indicative of potential exploitation of vulnerabilities such as CVE-2026-33825, where attacker-controlled file operations are redirected via junction points.
This rule detects attempts to disable Microsoft Defender security features or create exclusions via Windows Registry modifications or PowerShell cmdlets. It identifies tampering with Registry keys related to disabling AntiSpyware, behavior monitoring, or real-time protection, as well as the execution of PowerShell commands that adjust Defender preferences, such as disabling real-time monitoring or adding wide-scope file exclusions.
This rule detects modifications to critical Windows registry keys associated with disabling security features (Microsoft Defender, WDigest credential storage) or establishing persistence via Image File Execution Options (IFEO). These modifications are often performed by adversaries to impair defensive monitoring, bypass credential protections, or execute malicious code when specific processes start.
Detects the execution of commands to disable Microsoft Defender (specifically Set-MpPreference or stopping the WinDefend service) within 10 minutes of the first interactive user login on a host. This behavior is indicative of threat actors, such as Akira ransomware affiliates, performing anti-forensics and disabling security controls on newly provisioned or compromised systems.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects attempts to tamper with Windows Defender configuration using PowerShell cmdlets 'Add-MpPreference' to add exclusions or 'Set-MpPreference' to disable real-time monitoring. This behavior is consistent with ClickFix attack techniques intended to evade endpoint security defenses.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Form-grabbing and credential stealing malware-as-a-service
Rust-based ransomware family targeting enterprise environments
Detects the execution of interactive shell or scripting processes (e.g., cmd.exe, powershell.exe, wscript.exe) directly or indirectly spawned by the Microsoft Defender service (MsMpEng.exe). The rule identifies processes running at SYSTEM integrity in an interactive user session, which is indicative of a TOCTOU exploit against the Defender quarantine pipeline.
Page 19 of 43