Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects attempts to disable or tamper with Windows Defender settings, services, or registry keys via command-line execution (such as reg.exe, PowerShell, or sc.exe) or direct registry modifications.
Detects the addition of Microsoft Defender exclusions targeting the C:\Windows directory or SystemHealth\Update paths via PowerShell commands (Add-MpPreference/Set-MpPreference) or direct Registry modifications, which may indicate an attempt to evade security detection.
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Detects Java processes spawning PowerShell or Command Prompt to modify Windows Defender settings by adding exclusions for sensitive paths or extensions (such as AppData, Temp, Users Public, or ProgramData).
Detects potential defense evasion activity where Windows Defender configurations are modified or disabled, followed closely within 20 minutes by a silent, quiet, or unattended software uninstallation initiated by a script interpreter or command processor on the same device.
Detects use of wmic to add Microsoft Defender scan exclusions via the
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
MSFT_MpPreference WMI class, targeting a program-files path and executable named to
impersonate Windows Defender. HoneyMyte (Mustang Panda) ran this exact wmic invocation
before deploying the CoolClient backdoor to a fake "Microsoft\Windows Defender"
directory, excluding both the folder and the renamed sideloader defender.exe from
scanning.
The following analytic detects modifications to the Windows registry that disable the Windows Defender raw write notification feature. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the registry path associated with Windows Defender's real-time protection settings. This activity is significant because disabling raw write notifications can allow malware, such as Azorult, to bypass Windows Defender's behavior monitoring, potentially leading to undetected malicious activities. If confirmed malicious, this could enable attackers to execute code, persist in the environment, and access sensitive information without detection.
The following analytic identifies modifications in the registry to disable Windows Defender's real-time behavior monitoring. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender settings. This activity is significant because disabling real-time protection is a common tactic used by malware such as RATs, bots, or Trojans to evade detection. If confirmed malicious, this action could allow an attacker to execute code, escalate privileges, or persist in the environment without being detected by antivirus software.
This detection searches for ASR audit events that are generated when a process or application attempts to perform an action that would be blocked by an ASR rule, but is allowed to proceed for auditing purposes.
Matches distinctive DragonForce TURN/MQTT campaign artifact filenames only when combined with byte-level markers unique to the malware (PE structure, TURN/MQTT C2 infrastructure strings, or the loader's pipe-caret-pipe thread-trigger byte pattern), to avoid false positives on unrelated benign files sharing these names.
Detects multiple attempts to disable, stop, or tamper with security products, backup solutions, or AV/EDR agents. The rule monitors for malicious use of sc.exe, net.exe, taskkill.exe, and PowerShell cmdlets targeting security software, as well as registry modifications to disable security protections. This behavior is commonly observed in post-compromise stages of ransomware attacks for defense evasion.
Detects DLLs potentially associated with the 'Lorem Ipsum Loader' malware family. These DLLs are designed to sideload into legitimate applications and contain embedded shellcode that is encoded as a sequence of English words to bypass entropy-based detection. The rule looks for the presence of the word-encoded blob alongside specific filenames commonly used in this sideloading technique.
This rule detects attempts by an attacker to disable or modify Windows security software and features. It monitors for three distinct behaviors: execution of 'Set-MpPreference' to modify Windows Defender settings (exclusions or real-time monitoring), execution of 'sc.exe' to stop security-related services (such as EDR or AV services), and direct modification of Windows registry keys to disable Windows Defender components.
The following analytic identifies when a Windows Defender ASR rule disabled events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This detection searches for ASR rule disabled events that are generated when an ASR rule is disabled.
Matches distinctive DragonForce TURN/MQTT campaign artifact filenames only when combined with byte-level markers unique to the malware (PE structure, TURN/MQTT C2 infrastructure strings, or the loader's pipe-caret-pipe thread-trigger byte pattern), to avoid false positives on unrelated benign files sharing these names.
Detects attempts to disable Windows Defender by either executing known Defender Control utilities or by modifying registry keys associated with the disabling of anti-spyware features or the WinDefend service startup.
Detects 2CLoader samples containing the embedded config magic bytes alongside rolling-XOR, AES-GCM, and sha256-seed-derived key material used in its payload decryption chain
Detects files matching known SHA256 hashes of the masqueraded MSP360 RMM v2.5.0.67 installer and associated ScreenConnect/utility payloads used in phishing-to-dual-RMM campaigns
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects evidence of potential adversarial interference with Windows Defender updates and MRT.exe (Malicious Software Removal Tool). The rule correlates high volumes of temporary file creation in user directories with unauthorized access to MRT.exe by third-party processes and repeated Windows Defender update failures, indicating a potential attempt to disrupt endpoint security operations.
Detects the presence of known SHA256 hashes associated with the 'ccrtc' planter PowerShell scripts and C2 SDK JavaScript components. These files were identified as being dropped into 'C:\Windows\Temp' during the STAC4924 webshell intrusion campaign.
Page 1 of 43