Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
This rule detects when Windows Defender logs the deletion of its malware detection history. This action can be performed by an attacker to remove traces of their activity or to prevent the system from reporting previously detected malware.
Detects when the Windows Defender feature for scanning malware and potentially unwanted software is disabled. This is indicated by Event ID 5010 from the WinDefend service.
Detects when the Windows Defender antivirus scanning feature is disabled, indicated by Event ID 5012 from the WinDefend service. This action is often performed by adversaries to impair defenses and avoid detection.
Detects attempts to disable or modify Microsoft Defender features using PowerShell commands, specifically targeting various scanning and monitoring capabilities. The rule looks for `Add-MpPreference` or `Set-MpPreference` cmdlets combined with parameters like `DisableArchiveScanning`, `DisableRealtimeMonitoring`, `DisableIOAVProtection`, `DisableBehaviorMonitoring`, `DisableBlockAtFirstSeen`, `DisableCatchupFullScan`, or `DisableCatchupQuickScan` set to `$true` or `1`. It also includes detection for base64 encoded versions of these commands.
Detects the usage of "reg.exe" to add Windows Defender folder exclusions. This technique has been observed being used by QakBot (formerly Qbot) to add exclusions for folders within AppData and ProgramData, aiming to evade detection by the antivirus software.
Detects attempts to disable Windows Defender Tamper Protection by modifying the relevant registry key. Tamper Protection is a security feature that prevents malicious programs from changing important security settings.
Detects the execution of "ConfigSecurityPolicy.EXE" with command-line arguments containing URLs (ftp://, http://, https://). This Windows Defender binary can be abused by attackers to download or upload files, potentially leading to arbitrary file download or data exfiltration.
This rule detects attempts to remove Windows Defender definition files using the MpCmdRun.exe utility with the '-RemoveDefinitions -All' command-line arguments. This action is typically performed by adversaries to disable or impair Windows Defender's ability to detect malicious software, thereby facilitating their activities and avoiding detection.
Detects the execution of the Windows Defender `OfflineScannerShell.exe` from a non-standard directory. This binary is known to be vulnerable to DLL side-loading, specifically loading `mpclient.dll` from its current working directory. An adversary could place a malicious `mpclient.dll` in a non-standard directory and then execute `OfflineScannerShell.exe` from that directory to achieve arbitrary code execution.
Detects modifications to Windows Defender exclusion registry keys, which adversaries may use to disable or bypass antivirus scanning for specific files or paths.
Detects when Windows Defender Exploit Guard Network Protection is disabled by a registry modification. This action can be taken by an adversary to bypass security controls and facilitate malicious network activity.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' PowerShell cmdlet, specifically targeting settings like Controlled Folder Access and Attack Surface Reduction rules. This activity is indicative of an adversary trying to impair defensive capabilities.
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
This rule detects attempts to disable Windows Defender's security monitoring features using PowerShell or the 'sc.exe' utility. Specifically, it looks for PowerShell commands that include '-DisableBehaviorMonitoring $true' or '-DisableRuntimeMonitoring $true'. It also identifies 'sc.exe' commands used to stop, delete, or disable the 'WinDefend' service (Windows Defender Antivirus Service). This activity is indicative of an adversary trying to impair defenses to avoid detection.
Detects attempts to remove or modify Windows Defender configurations using the 'Remove-MpPreference' cmdlet, specifically targeting settings related to Controlled Folder Access and Attack Surface Reduction Rules. This activity is often indicative of an adversary trying to disable security features to facilitate further malicious actions.
This rule detects attempts to disable Windows Defender's Potentially Unwanted Application (PUA) protection by monitoring changes to the 'PUAProtection' registry key. Specifically, it triggers when the 'PUAProtection' value is set to '0x00000000' (DWORD 0), indicating that PUA protection has been disabled.
Detects base64 encoded PowerShell commands that use 'Add-MpPreference' or 'Set-MpPreference' cmdlets to modify or tamper with Windows Defender Antivirus settings. This is a common technique used by adversaries to disable or reduce the effectiveness of endpoint security solutions.
Detects blocking of process creations originating from PSExec and WMI commands
Detects triggering of AMSI by Windows Defender.
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Detects Access to LSASS Process
Page 41 of 43