Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Based off of BlueHammer Local Priv Escalation, exploiting Windows Defender's signature file handling
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Windows Defender logs when the history of detected infections is deleted.
Detects issues with Windows Defender Real-Time Protection features
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects specific registry modifications performed to turn off Windows Defender features such as Tamper Protection, Real-Time Monitoring, and AntiSpyware, or to modify the WinDefend service startup type. This rule identifies attempts to impair defensive capabilities on a Windows system.
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
Detects the use of PowerShell to disable various aspects of Microsoft Defender. This technique is commonly used by malware to evade detection before executing malicious payloads.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
Detects attempts to disable Windows Defender/Security features via command line arguments targeting antivirus, behavior monitoring, real-time protection, and WMI autologger defender components.
Detects the use of PowerShell to disable or weaken Microsoft Defender security features. This technique is commonly used by malware to evade detection before executing malicious payloads, as seen in the referenced Fortinet report.
Detects PowerShell commands used by Prometei to add Microsoft Defender exclusions for its staging and configuration directories ('C:\Windows\Dell' or 'Intel\Support'). This is a common defense evasion tactic.
Detects the use of the legitimate Windows binary 'SystemSettingsAdminFlows.exe' to spawn a child process that disables Windows Defender settings. This is a LOLBin technique used for defense evasion as observed in campaigns leveraging the Apache ActiveMQ exploit.
This rule detects PowerShell being used to add Windows Defender exclusions for file paths and processes associated with the ValleyRAT malware campaign. Specifically, it looks for `Add-MpPreference` command-line arguments that include `-ExclusionPath` with "trvePath" or `-ExclusionProcess` with "WavesSvc64.exe".
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware like MKDOOR to prevent detection.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects attempts to tamper with Windows Defender settings using PowerShell. This includes adding exclusions for paths/extensions or disabling real-time monitoring, which are techniques used by malware like the PHALT#BLYX campaign to evade detection.
Page 31 of 43