Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects the reflectively-loaded SectopRAT .NET payload by its combination of heavy calli (indirect call) opcode usage for control-flow flattening and its characteristic runtime string-decryption helper method used to resolve the C2 IP/port and other obfuscated strings
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
Matches known SHA-256 hashes of AvisLoader toolkit components recovered from an exposed staging server: the Windows loader client, UAC-bypass helper, and process-hiding DLL
Matches known SHA-256 hashes of AvisLoader toolkit components recovered from an exposed staging server: the Windows loader client, UAC-bypass helper, and process-hiding DLL
Detects the execution of the KRSID ransomware binary, which is written in Rust. The rule identifies the malware based on its unique file extensions, ransom note filenames, specific command-line arguments, log file indicators, and compiled code characteristics.
Detects ZIP archives exceeding 100MB that contain specific DLL filenames often used for junk-padding to evade sandbox analysis. This technique is observed in brand-impersonation campaigns targeting users with fake security or authentication software lures.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding exclusion paths, processes, or extensions shortly after the creation of Registry Run keys. This sequence is characteristic of post-exploitation activity where an adversary establishes persistence and subsequently attempts to neutralize security software monitoring of their malicious payloads to avoid detection during future execution.
Detects attempts to modify AMSI (Antimalware Scan Interface) provider registry keys or tampering with the amsi.dll file. These actions are indicative of efforts to disable or blind security instrumentation, often as a precursor to or during malicious code execution.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects the BTR.sys driver, a tool identified as being extracted from Microsoft's MpEngine.dll and repurposed for kernel-level file and registry manipulation. The rule matches on specific SHA-256 file hashes or combinations of PE metadata strings, indicating the presence of this driver on the system.
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
Detects attempts to modify, disable, or query Microsoft Defender configuration settings or status using legitimate Windows management tools (PowerShell/WMI) by processes other than authorized Defender executables (MsMpEng.exe, MpCmdRun.exe).
Detects the presence of KRSID ransomware by identifying specific embedded strings associated with its configuration, including ransom notes (README_KRSID.Txt), log files (ransomware-silent.Log), encrypted file extensions (.krsid), and common command-line arguments used for operational control.
Detects Hancom HWP documents that contain an OLE BIN0001.OLE stream and specific JScript storage structures, which are indicative of a weaponized document used to execute scripts and fetch remote payloads from a specific command-and-control URL.
Detects the addition of exclusion paths to Microsoft Defender via PowerShell (Add-MpPreference or Set-MpPreference) initiated by non-Microsoft signed processes or specific messaging applications. This behavior is often indicative of malware attempting to exclude malicious payloads from security scanning.
Detects the presence of known Vidar Stealer malware binaries (internal build versions 2.0 through 3.4) by matching their SHA256 file hashes. Vidar is an infostealer malware typically used to exfiltrate sensitive data from victim systems.
Detects the presence of PIVOTPIPE .NET loader components within files by searching for specific magic bytes, debug strings, hardcoded developer file paths, and agent-related operational strings.
This rule detects the presence of ZigCryptoStealer malware deployed via a NativeAOT-compiled Windows executable. The detection relies on identifying specific hardcoded infrastructure strings, such as a BNB Smart Chain RPC endpoint and a specific contract address used to resolve C2 domains. It also looks for common sideloading hosts associated with the malware's delivery.
Detects attempts to disable Windows Defender features via PowerShell, terminate critical security services using administrative tools like sc.exe or net.exe, or inject/patch AMSI (Antimalware Scan Interface) within a process context to evade detection.
Page 6 of 43