Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities
Detects scenarios where an attacker tamper Defender RTP protection and disable it.
No description available.
Detects the usage of "reg.exe" to tamper with various Windows Defender registry keys. This tampering aims to disable important features related to protection and detection, such as real-time monitoring, cloud protection, tamper protection, and other security functionalities. The rule specifically looks for `reg.exe` commands adding or modifying DWORD values to '0' or '1' for known Windows Defender settings.
This detection identifies the use of two drivers, rwdrv.sys and hlpdrv.sys, which have been observed in Akira ransomware campaigns. The activity includes dropping these drivers, creating associated services, and disabling Windows Defender.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
This rule detects attempts to tamper with Windows Defender's real-time protection settings by monitoring specific registry key modifications. It specifically looks for "TamperingAttempt" actions targeting the 'HKEY_LOCAL_MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\Real-Time Protection' registry key, which is commonly used to disable or modify Windows Defender's real-time scanning capabilities.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
Detects the use of `reg.exe` or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
Catches registry modifications that disable security features like Windows Defender, often part of ClickFix attacks where users are told to “fix” security issues by disabling protection.
This detection identifies attempts to disable or tamper with Microsoft Defender Antivirus using common command-line tools. This is a frequent defense evasion technique used by threat actors, including those exploiting SharePoint vulnerabilities, to operate undetected on a compromised host.
Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)
This rule detects modifications to Windows Defender exclusion paths in the registry. Adversaries may modify these registry keys to add exclusions for their malicious files or processes, allowing them to evade detection by Windows Defender. The rule specifically looks for changes to the 'Exclusions\Paths', 'Exclusions\Processes', and 'Exclusions\Extensions' keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender.
KQL Query from file: defendnot detection
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects suspicious changes to the Windows Defender configuration
Page 34 of 43