Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Detects PowerShell or command-line modification of Defender real-time monitoring immediately before ransomware activity. This rule specifically looks for commands that disable real-time monitoring within Microsoft Defender.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Hunts for the TiFlux agent executing commands to modify Windows Defender or Firewall registry keys to lower security postures.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects the final payload stage of LokiBot infostealer, characterized by a 32-bit Windows PE file built with MSVC 2015. The rule identifies specific known malicious file hashes or a structural signature featuring a non-standard PE section named 'x', which is used by the malware to store 3DES-encrypted C2 endpoint addresses.
Detects various methods employed by LCRYX ransomware to disable security software and firewall configurations. The rule identifies suspicious process executions, including PowerShell commands to modify Windows Defender settings, netsh commands to disable firewalls, sc.exe commands to stop security services, and the termination of various antivirus processes (e.g., MsMpEng.exe, avp.exe, bdagent.exe) via taskkill. It specifically monitors these actions when spawned from script hosts like wscript, cscript, or shells like powershell and cmd.
This rule detects unauthorized attempts to disable Microsoft Defender Antivirus features using the Set-MpPreference PowerShell cmdlet. By monitoring the command line arguments for multiple disable flags (such as -DisableRealtimeMonitoring, -DisableBehaviorMonitoring, etc.), the rule flags activity where an attacker or unauthorized user is attempting to impair host-based security defenses.
This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware to prevent detection.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the initialization sequence of the Millenium RAT, which attempts to weaken host security by adding the entire C:\ drive as an exclusion path for Windows Defender using the Add-MpPreference PowerShell cmdlet.
Identifies attempts to exclude the C drive or powershell from Defender scanning, often associated with malware like AsyncRAT. The rule specifically looks for PowerShell commands using 'Add-MpPreference' with '-ExclusionPath' or '-ExclusionProcess' targeting 'C:\' or 'powershell.exe'.
This rule detects attempts to disable Microsoft Defender's real-time monitoring or behavior monitoring features using PowerShell. It specifically looks for `powershell.exe` executing `Set-MpPreference` with the `-DisableRealtimeMonitoring` or `-DisableBehaviorMonitoring` parameters set to `1`, `$true`, or `True`.
Detects PowerShell executing the Add-MpPreference cmdlet specifically excluding the targeted mining executables (RuntimeHost.exe, lolMiner.exe, gminer.exe). This activity is indicative of an attacker attempting to disable or bypass Windows Defender's real-time protection for known cryptomining executables, a common tactic in cryptojacking campaigns.
Detects modifications to Microsoft Defender configuration registry keys to disable protection features.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Page 26 of 43