Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
This rule detects attempts to tamper with Windows Defender settings using PowerShell's Set-MpPreference cmdlet. Specifically, it looks for commands that disable various Defender features like real-time monitoring, behavior monitoring, archive scanning, or set default threat actions to 'Allow'. This activity is indicative of an adversary trying to impair defensive capabilities on a system.
Detects when attackers or tools disable Windows Defender functionalities by modifying specific registry keys. This rule looks for changes to various Windows Defender related registry paths, specifically setting DWORD values to either 0x00000001 (to disable certain features) or 0x00000000 (to disable other features like Tamper Protection or PUA Protection).
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects when Windows Defender Real-time Protection is disabled. This event may not contain detailed information about the initiator, requiring further investigation.
This rule detects blocked attempts to modify Microsoft Defender Antivirus settings when Tamper Protection is enabled. Specifically, it looks for Event ID 5013 from the Windows Defender service, which indicates that Tamper Protection has blocked a change to Defender's configuration. The rule targets attempts to disable key features such as AntiSpyware, AntiVirus, archive scanning, network file scanning, real-time monitoring, behavior monitoring, IOAV protection, and script scanning by monitoring specific registry value paths.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects the use of PowerShell cmdlets 'Add-MpPreference' or 'Set-MpPreference' in conjunction with parameters like '-ExclusionPath', '-ExclusionExtension', '-ExclusionProcess', or '-ExclusionIpAddress' to configure exclusions for Microsoft Defender Antivirus. This activity is often associated with defense evasion tactics used by adversaries to prevent security software from detecting their malicious activities.
This rule detects when a file is restored from quarantine by Microsoft Defender Antivirus. This action is logged with Event ID 1009 in the Microsoft-Windows-Windows Defender/Operational event log. While legitimate administrators might restore files, this event can also indicate an adversary attempting to reintroduce malicious files that were previously quarantined, potentially as part of a defense evasion strategy.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe) as indicated by an Application Error event (EventID 1000) containing both 'MsMpEng.exe' and 'mpengine.dll' in the event data. Such crashes could be indicative of an attempt to bypass or disable antivirus defenses, potentially through exploitation of vulnerabilities in the engine.
This rule detects events indicating issues with Windows Defender Real-Time Protection features. Specifically, it triggers when Real-Time Protection encounters an error and fails (EventID 3002) or when a Real-Time Protection feature restarts (EventID 3007). It filters out common false positives related to Network Inspection System errors due to missing updates or unknown antimalware security intelligence issues.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe), specifically when the mpengine.dll module is involved. Such crashes can indicate an attempt to exploit vulnerabilities in the antivirus software to bypass security defenses or disable the tool. The detection relies on Windows Error Reporting (EventID 1001) logs containing specific process and module names.
Detects modifications to Windows Defender configuration settings using PowerShell to add exclusions. This activity is often performed by adversaries to disable or bypass security controls, allowing their malicious activities to go undetected.
Detects suspicious changes to Windows Defender's configuration settings, which could indicate an attempt to disable or impair its protective capabilities. This rule specifically looks for modifications to registry keys related to disabling anti-spyware, removable drive scanning, network drive scanning, cloud-delivered protection (Block at First Seen), and real-time protection reporting.
This rule detects when the Windows Defender operational event log is disabled by setting its 'Enabled' registry value to 0. This activity has been observed in relation to Lockbit 3.0 ransomware infections as a defense evasion technique.
This rule detects when exclusions are added to Windows Defender. Adversaries often add exclusions to security software to prevent their malicious tools and activities from being detected. This specific rule looks for Event ID 5007, which indicates a change in the antimalware platform configuration, and checks if the new configuration value contains the string '\Microsoft\Windows Defender\Exclusions'. This indicates that a path or file has been added to Windows Defender's exclusion list.
Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.
Detects actions taken by Windows Defender malware detection engines, indicating that malware or potentially unwanted software has been found, suspicious behavior has been detected, or an action has been performed to protect the system.
Detects when the grace period for Windows Defender expires, indicating that protection against viruses, spyware, and other potentially unwanted software is disabled. This event suggests a critical security control has been impaired.
Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
Page 40 of 43