Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects attempts to disable or modify Windows Defender security features, such as Real-time Monitoring, Tamper Protection, or adding unauthorized exclusion paths via PowerShell cmdlets or direct registry modifications.
Detects attempts by malicious software, specifically SloppyRAT, to query or modify Microsoft Defender settings by interacting with WMI classes like MSFT_MpPreference or MSFT_MpComputerStatus. This activity is indicative of efforts to disable security controls such as real-time monitoring to facilitate further malicious actions.
Detects the presence of the CastleLoader intermediate loader binary on disk, associated with the SloppyRAT infection chain. The rule identifies specific file content patterns, including hardcoded strings such as 'CastleLoader', 'CastleRAT', specific user-agents, and embedded Python code used for base64/zlib decoding of further payloads.
Detects the presence of the known vulnerable gdrv.sys driver on disk. This driver is frequently utilized in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode access, which is often leveraged to disable endpoint security products or escalate privileges.
Detects the use of wevtutil.exe to clear the Microsoft-Windows-Defender/Operational event log, which is often done by adversaries to remove evidence of security software activity or detection.
Detects Settra ransomware binaries characterized by naming conventions including '_win64.exe', which create 'RESTORE_FILES.txt' ransom notes and use '.locked' or '.locked_wip' file extensions for encrypted data.
Detects unauthorized attempts to disable Windows Defender Tamper Protection by setting the TamperProtection registry value to 0. This action allows an adversary to weaken system security, potentially enabling them to modify Defender exclusions or stop security services without interference.
Detects the use of PowerShell to modify Windows Defender exclusions by adding the 'C:\' drive root as an exclusion path. This technique, which can be executed via 'Add-MpPreference', 'Set-MpPreference', or 'Invoke-CimMethod', effectively disables real-time scanning across the entire system drive and is often employed by adversaries to hide malicious activity from antivirus detection.
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects the use of PowerShell to modify Microsoft Defender (MpPreference) settings by adding specific directories or files to the exclusion list. This behavior is frequently associated with adversaries attempting to evade security detection by ensuring malicious tools, staged payloads, or persistent files remain unscanned by the antivirus engine.
Detects artifacts associated with the CRUDEEXCLUDE Delphi-based loader, which is used to deploy the HEAVYGRAM backdoor. The rule identifies a combination of Delphi indicators, anti-analysis sandbox connectivity checks, decoy message boxes, and attempts to modify Windows Defender exclusions for specific paths associated with the malware's activity.
Detects the execution of PowerShell commands using 'Add-MpPreference -ExclusionPath' initiated by the CRUDEEXCLUDE Delphi utility. This behavior is associated with threat actors staging directories for the deployment of HEAVYGRAM/SHADEGENES payloads.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects rapid deletion and creation cycles of the WD_SCAN object manager link, a behavioral pattern associated with a Time-of-Check-to-Time-of-Use (TOCTOU) exploit chain targeting Windows Defender (referenced as CVE-2026-69414). The rule monitors for at least three cycle events occurring within a 5-second window, specifically involving the 'WD_SCAN' object identifier.
Detects the CastleRAT intermediate loader, which acts as a secondary stage before deploying SloppyRAT. The rule identifies the malicious payload by scanning for unique embedded strings, specific user-agent strings, and command-and-control (C2) communication patterns (domains and URI paths) within executable files.
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Page 9 of 43