Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
311 detections
Filters
Last updated
All Time
Detection languages
184
28
21
21
21
Contributors
88
85
46
21
17
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
259
40
20
6
3
Products / Services
113
76
51
37
35
MITRE Techniques
122
89
87
64
63
CVEs
6
5
3
1
1
Detects a Node.js process termination followed by a quick respawn of a new Node.js process by the same parent process. This pattern suggests a watchdog persistence mechanism where the parent process monitors the child, automatically restarting it if it is terminated, consistent with behaviors observed in malware such as Void Dokkaebi.
Detects the use of taskkill.exe to forcibly terminate a process named 'svehost.exe'. This is often used by adversaries to terminate a process masquerading as a legitimate system process, or potentially an attempt to terminate an impostor service. Note that 'svehost.exe' is a common typo/masquerade for the legitimate 'svchost.exe'.
This rule monitors for the loading of a specific driver file, 'pcdhost.sys', followed by a process termination event within a five-minute window. This behavior is indicative of a 'Bring Your Own Vulnerable Driver' (BYOVD) attack pattern, where an adversary loads a vulnerable driver to gain kernel-level access or elevate privileges, often followed by the cleanup or termination of the process that facilitated the loading.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
Detects the manual or malicious termination of security-related processes, including antivirus software, endpoint protection agents, and diagnostic/monitoring tools (e.g., Task Manager, Process Explorer, Wireshark). Such behavior is often indicative of an adversary attempting to impair security defenses to facilitate further malicious activity.
Detects attempts to disable or tamper with Microsoft Defender by terminating its processes, stopping its associated services, adding directory exclusions, or modifying registry keys used to control its behavior and security settings.
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
Detects the use of PowerShell to forcefully terminate 'wscript.exe' using 'Stop-Process' or 'taskkill'. This behavior is associated with adversaries, such as those in the VEIL#DROP campaign, attempting to minimize forensic evidence after executing malicious JavaScript lures via Windows Script Host.
Detects a Windows system BugCheck (Blue Screen of Death) event that occurs within two minutes of a process termination event. This behavior can be indicative of a process intentionally causing a system crash, often utilized by malware that abuses critical-process protection or attempts to evade analysis by forcing a system halt.
Detects the execution of systeminfo.exe or wmic.exe that terminates within 5 seconds. This behavior is indicative of automated environment or sandbox discovery techniques, often performed by malware loaders such as those associated with the Turb00 operation or similar campaigns to fingerprint the victim machine prior to executing malicious payloads.
Detects the mass termination of processes related to productivity suites (Office, Thunderbird), database management (SQL, Oracle, MySQL, Postgres), system backups (VSS), and security monitoring/analysis tools (Task Manager, Wireshark, Process Explorer/Monitor). This activity is highly suspicious and may indicate an attacker attempting to disrupt services, hinder analysis, or prepare a host for destructive activities like data encryption or deletion.
Detects the privilege escalation sequence used by VILE ransomware, which involves manipulating process tokens via a combination of OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, GetTokenInformation, SetTokenInformation, and DuplicateTokenEx. This is followed by the termination of processes using TerminateProcess, typically performed to release locked files before encryption.
Detects the use of taskkill.exe with the force flag (/f) to terminate critical system processes like explorer.exe, or common security and administrative tools such as task manager, registry editor, process hacker, or antivirus software. This activity is often associated with malicious actors attempting to impair security controls or evade detection.
This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
Detects abnormal termination, crash, or error messages related to the 'sharingd' process on macOS. 'sharingd' is a daemon responsible for various sharing features including AirDrop, Handoff, and Instant Hotspot. Unexpected errors or crashes within this process may indicate service instability, potential exploitation attempts, or abnormal interactions with sharing services.
This rule detects potential exploitation of an out-of-bounds write vulnerability in Python's Pillow library (ImageCms module). It identifies Python processes initialized with indicators related to known exploit research (exploitarium) that subsequently terminate with error signals indicative of a crash, such as heap-buffer-overflows or memory management errors, suggesting successful or attempted exploitation.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
Page 10 of 15