Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects the use of PowerShell to modify Microsoft Defender exclusion paths by adding root drive letters or temporary directory paths. This behavior is indicative of defense evasion techniques often employed by ransomware families, such as Nova or Gentlemen, to prevent the scanning of files immediately prior to encryption.
Detects known AgtaBackup RAT staged installers and dropped payload via SHA-256 hash or characteristic filenames
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Matches known SHA-256 hashes for the BotHelper stager (WindowsUpdate.exe) and RAT (msedge_proxy.exe)
Detects a fake ClaudeDesktop.exe installer / tampered libcef.dll sideload chain deploying the SectopRAT .NET RAT, requiring multiple corroborating indicators and a PE anomaly consistent with DLL sideloading rather than a single generic string
The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks.
Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the
symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact,
its alternate data stream, and their subsequent removal.
Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the
symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact,
its alternate data stream, and their subsequent removal.
Detects the use of PowerShell cmdlets (Add-MpPreference or Set-MpPreference) to modify Microsoft Defender exclusions (paths, processes, or extensions). This behavior is often associated with adversaries attempting to evade security detection by excluding malicious files or processes from being scanned by Microsoft Defender.
Detects a coordinated malicious installation chain involving the creation of specific mutexes, establishment of persistence via Windows Registry Run keys, and subsequent tampering with Microsoft Defender exclusions using PowerShell. This sequence is indicative of the CHOSEN BRICK malware installation process.
Detects known components of the Sauron malware, including MSI installers, side-loaded executables (rnpkeys.exe), and malicious DLLs (rnp.dll, tdwp.dll) by matching known SHA-256 file hashes. It also includes a YARA rule for detecting PE binaries containing the string 'Sauron'.
Detects the presence of an unpacked Sauron Loader DLL by identifying a specific embedded configuration header (magic value 0xbaadf00d followed by flags 0x40) in conjunction with configuration fields like 'group_id' or 'build_id'. This rule is intended for static analysis of file samples.
Detects the presence of known AnonyMousKIT Phishing-as-a-Service (PhaaS) shared components (legacy.js, Core.js, ToolsController.php) by matching specific file hashes or detecting these filenames in small files. This rule is designed to identify backend infrastructure used by phishing resellers.
Detects evidence of potential adversarial interference with Windows Defender updates and MRT.exe (Malicious Software Removal Tool). The rule correlates high volumes of temporary file creation in user directories with unauthorized access to MRT.exe by third-party processes and repeated Windows Defender update failures, indicating a potential attempt to disrupt endpoint security operations.
Detects the installation or configuration of the NvFsFilter (Alinubx.sys) persistence driver, often associated with malicious behavior that continuously terminates security software processes to allow for persistent unauthorized activity after system reboots.
This rule detects attempts by an attacker to disable or modify Windows security software and features. It monitors for three distinct behaviors: execution of 'Set-MpPreference' to modify Windows Defender settings (exclusions or real-time monitoring), execution of 'sc.exe' to stop security-related services (such as EDR or AV services), and direct modification of Windows registry keys to disable Windows Defender components.
Detects a fake ClaudeDesktop.exe installer / tampered libcef.dll sideload chain deploying the SectopRAT .NET RAT, requiring multiple corroborating indicators and a PE anomaly consistent with DLL sideloading rather than a single generic string
Detects the UAT-11587 TestAssembly.dll downloader by its shared AssemblyAttribute GUID b2b3adb0-1669-4b94-86cb-6dd682ddbea3 embedded in .NET metadata across all campaign builds
Detects Antino backdoor binaries (slc.dll and standalone) via embedded AntinoApp application manifest string and Rust PDB path patterns matching GitHub Actions Windows runner structure.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Page 3 of 43