Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects the use of WMIC to add a file path to the Microsoft Defender exclusion list. This specific command structure is a known technique used by the MKDOOR backdoor to evade detection.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to add an exclusion (Path, Process, or Extension) to Microsoft Defender. This technique is used by malware, such as the MKDOOR backdoor, to prevent detection by security products.
This query detects attempts to disable or modify critical security services using either the 'sc.exe' utility or direct registry modification. This is a common defense evasion technique used by adversaries to weaken a system's security posture before performing further actions.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
Detects the use of PowerShell to add exclusions to Windows Defender. This technique was observed in the PHALT#BLYX campaign where attackers added exclusions for the 'C:\ProgramData' directory and for file extensions like '.exe', '.ps1', and '.proj' to prevent their malware from being detected.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects PowerShell commands used to add exclusions to Windows Defender or disable real-time monitoring. This is a known defense evasion technique (T1562.001) used by adversaries, including the PHALT#BLYX campaign, to allow malicious components to operate without being detected.
Detects the execution of "ClipUp.exe" with specific command-line parameters used to abuse Protected Process Light (PPL) to tamper with the Microsoft Defender process ("MsMpEng.exe"). This technique was observed in the RONINGLOADER campaign.
Detects attempts to disable Windows Defender's real-time monitoring feature by modifying its corresponding registry key. This technique is commonly used by malware, such as FormBook RAT, to evade detection.
Detects network traffic to Solana RPC endpoints containing the wallet address associated with the GlassWorm malware. GlassWorm uses the Solana blockchain as a resilient C2 mechanism by querying for transactions from an attacker-controlled wallet.
Detects a Python process creating a scheduled task or adding a Windows Defender exclusion, a technique used by malware like InvisibleFerret for persistence and defense evasion.
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
Detects Cephalus ransomware behavior, specifically the deletion of Volume Shadow Copies and tampering with Windows Defender settings, which are common precursor activities to encryption.
This query identifies onboarded devices in the environment that have not completed a successful antivirus scan within the last 30 days. It provides visibility into endpoint compliance, ensuring that all devices are actively monitored and protected by Microsoft Defender or other antivirus solutions.
Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
Maintaining up-to-date AV scan activity is critical as devices without recent scans may harbor unobserved threats or be at increased risk of compromise.
Yara rule that detects EggStremeFuel backdoor.
Detects the use of PowerShell to add exclusions to Microsoft Defender, which can be an attempt by an adversary to impair defenses and prevent detection of malicious activities.
Yara rule that detects WeaselStore infostealer.
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs. This activity may indicate an attempt to sideload arbitrary DLLs into legitimate Microsoft Defender processes, potentially for privilege escalation, persistence, or defense evasion.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects potential DLL sideloading of "mpclient.dll" by legitimate Windows Defender processes ("MpCmdRun.exe" and "NisSrv.exe") when they are executed from a non-standard directory. This technique can be used by adversaries to execute malicious code under the guise of a trusted process, potentially leading to privilege escalation, persistence, or defense evasion.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
Page 32 of 43