Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
This rule detects attempts to disable or interfere with endpoint security products, including Windows Defender and various third-party antivirus agents. It identifies suspicious process executions involving command-line tools like sc.exe, net.exe, or taskkill.exe targeting security services, or the direct modification of Windows registry keys associated with security policy disabling. The detection is further scoped to processes originating from or associated with common suspicious paths (e.g., AppData) or known malicious naming patterns.
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
IoT botnet malware family used for DDoS and proxy infrastructure
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Malvertising loader delivering CastleStealer via malicious Google Ads
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Latin American banking trojan using DLL side-loading and overlay attacks
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Loader malware delivering follow-on ransomware payloads
Ransomware group exploiting edge devices and managed file transfer software
Detects instances where the Microsoft Defender service (MsMpEng.exe) spawns common system utilities like cmd.exe, powershell.exe, or wscript.exe running with SYSTEM integrity. This is highly anomalous as Defender should generally not be the parent process for these interactive or script execution shells.
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
Open-source derived remote access trojan with plugin architecture
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects attempts to terminate security-related processes or stop security-related services using common administrative tools like taskkill.exe, sc.exe, net.exe, or net1.exe. This activity is often indicative of an adversary attempting to disable security monitoring and protection software to facilitate further malicious actions.
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Detects the execution of batch files that perform multiple actions to impair or disable security tools, including Windows Defender, Sysmon, Filebeat, and IIS logging components. The rule monitors for a pattern of suspicious process commands (stop, config, delete, kill, Set-MpPreference) originating from a .bat file, flagging hosts where two or more distinct impairment actions are executed by the same parent process.
Page 21 of 43