Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Detects behavior associated with the Glove Stealer malware, specifically the disabling or modification of Windows Defender, the use of UAC auto-elevate binaries (fodhelper.exe, computerdefaults.exe) initiated by non-standard processes, and unauthorized modifications to Windows Defender registry keys.
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects attempts to disable Microsoft Defender security features. The rule monitors for PowerShell cmdlets (Set-MpPreference), service control operations (sc.exe stopping WinDefend), and registry modifications to the 'DisableAntiSpyware' policy key, which are common methods used by adversaries to impair host-based security defenses.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
Detects attempts to disable or tamper with Windows Defender via command-line utilities, PowerShell scripts, or registry modifications. This includes stopping services (sc/net), modifying Defender preferences (Set-MpPreference), and tampering with policy registry keys.
Detects coordinated efforts to impair host-based security by disabling Microsoft Defender via Set-MpPreference, terminating security agent processes (e.g., Sysmon, Filebeat, SentinelOne), stopping security services, or executing known security-disabling PowerShell scripts.
Detects the addition of Microsoft Defender exclusions (Path, Extension, or Process) via WMIC or PowerShell, followed by a file creation event within a suspicious directory (e.g., Temp, AppData, ProgramData) within 15 minutes. This behavior is indicative of an adversary attempting to bypass antivirus detection for malicious payloads.
Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.
Detects the use of PowerShell commands 'Add-MpPreference' or 'Set-MpPreference' to add the entire C drive as an exclusion path for Windows Defender. This is a common technique used by attackers to disable security monitoring for the entire file system.
Detects attempts to stop or modify critical Windows security services (Windows Defender, Security Center, Security Health Service) using the Service Control utility (sc.exe). This activity is often indicative of an adversary attempting to impair defenses.
Detects potential exploitation of CVE-2026-45498 (UnDefend) or related defense evasion by identifying registry modifications that disable Microsoft Defender AntiSpyware or real-time monitoring protections under the Windows Defender policy key, or suspicious invocation of MpCmdRun.exe with signature update arguments from an unexpected parent process.
Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.
Detects attempts to disable or tamper with security software, including Windows Defender, Windows Firewall, and various third-party antivirus agents, via PowerShell commands, service management utilities, or registry modifications.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Page 23 of 43