Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Correlates Run Command execution with immediate subsequent Defender Antivirus tampering on the endpoint. This rule detects attempts to disable or modify Microsoft Defender Antivirus settings using PowerShell commands like 'Set-MpPreference' or 'DisableRealtimeMonitoring' when initiated by 'RunCommandExtension.exe'. This activity is indicative of an attacker attempting to impair defenses.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Hunts for SimpleHelp executing reg.exe commands to disable Windows Defender components (DisableRealtimeMonitoring, DisableAntiSpyware) prior to encryption.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
Detects disabling of Windows Defender through registry modifications
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
Detects attempts to disable Windows Defender features by modifying specific registry values. This rule looks for changes to registry keys under `\Policies\Microsoft\Windows Defender` where values like `DisableAntiSpyware`, `DisableRealtimeMonitoring`, `DisableBehaviorMonitoring`, or `DisableIOAVProtection` are set to '1', indicating an attempt to disable these security features.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
Defender exclusion for the Hola path
Cortex XDR
This rule detects attempts to modify Windows Defender preferences to exclude the Hola application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun that include 'add-mppreference', 'exclusion', and 'hola' keywords, indicating an attempt to bypass antivirus scanning for the Hola application.
Detects addition of AV exclusion paths to hide malicious files from scanning
This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects attempts to disable Defender Real-Time Monitoring by modifying a specific registry key and value. This action indicates an adversary trying to impair defensive capabilities.
Detects attempts to disable Microsoft Defender's Behavior Monitoring feature by modifying specific registry keys. This activity is often indicative of an adversary trying to evade detection by security software.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
Page 28 of 43