Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
167 detections
Filters
Last updated
All Time
Detection languages
58
48
39
10
5
Contributors
38
32
20
19
15
Categories
84
63
56
20
15
Platforms
152
13
6
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
87
63
34
28
26
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
3
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
Detects network activity associated with the Grandoreiro banking trojan, specifically identifying C2 communication tunneled over WebRTC/STUN (port 3478) or MQTT (Azure/Google Cloud services) originating from processes executing out of the AppData\Local directory. This behavior aligns with Grandoreiro's known DLL side-loading mechanism where legitimate but vulnerable binaries are used to load malicious libraries.
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects incoming network connections to Windows 'Nearby Share' process components from external (non-RFC1918) IP addresses. This activity is potentially malicious as legitimate 'Nearby Share' traffic should typically occur within local networks.
Detects incoming network connections to Windows 'Nearby Share' process components from external (non-RFC1918) IP addresses. This activity is potentially malicious as legitimate 'Nearby Share' traffic should typically occur within local networks.
Detects attempts by LCRYX ransomware to disable security protections, including Windows Defender real-time monitoring and firewall, as well as third-party antivirus software (Bitdefender, Kaspersky). The detection monitors process creation events for malicious command-line arguments, excluding legitimate administrative processes like msiexec.exe or services.exe.
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.
Detects the use of netsh.exe to create a firewall rule specifically named "SH Remote Access Service Launcher". This activity is associated with the JWrapper/SimpleHelp RAT, which adds this rule to allow inbound C2 connections, bypassing the system firewall.
Detects attempts to disable or modify Windows Firewall settings using netsh, PowerShell, or direct registry modifications. Adversaries often perform these actions to evade detection and maintain uninhibited network communication for C2 or data exfiltration.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
This rule detects the execution of known SMB exploitation tools (e.g., Python-based SMBGhost scanners/payloads, Metasploit resource scripts for EternalBlue) and identifies high-fan-out SMB scanning activity or unauthorized SMB connections from non-standard processes to an internal subnet (10.39.x.x).
Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.
Detects attempts to disable or tamper with security software, including Windows Defender, Windows Firewall, and various third-party antivirus agents, via PowerShell commands, service management utilities, or registry modifications.
Detects the netsh utility being abused to explicitly open port 3389 in the Windows Defender Firewall to allow inbound RDP traffic.
Detects the use of WScript or CScript (Windows scripting engines) to launch commands intended to disable or tamper with security products, including Windows Defender, system firewalls, Bitdefender, and Kaspersky antivirus solutions.
Page 3 of 8