Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
31
7
6
6
4
Contributors
21
10
8
5
4
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
52
2
2
2
1
Products / Services
20
16
15
9
8
MITRE Techniques
30
30
23
23
21
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
Detects the execution of batch scripts or direct command-line operations (taskkill, sc, net, powershell, wmic) specifically targeting the termination, deletion, or disabling of common endpoint security software such as Microsoft Defender, Sysmon, Filebeat, and other agent-based security tools.
Detects the execution of 'i.bat' script accompanied by subsequent commands intended to exhaustively impair security defenses on a Windows host. The rule identifies the combination of the script execution and targeted commands to disable Microsoft Defender, stop Sysmon/Filebeat services, and uninstall or misconfigure ModSecurity modules.
Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Identifies the EDR Killer utility deleting the vulnerable .sys driver and its associated service after the EDR has been permanently blinded. This rule specifically looks for 'cmd.exe' executing commands to delete services ('sc delete') or delete .sys files ('del *.sys'), combined with a driver load event for a .sys file.
Detects JFMBackdoor activity where a sideloaded fltMC.exe executable located in a temporary directory initiates process enumeration using tasklist.exe or performs service lifecycle management operations (delete, start, stop, create, or query) using the sc.exe utility.
Detects execution patterns where security tools such as Microsoft Defender, Sysmon, and Filebeat are intentionally impaired or disabled using service control commands (sc.exe) and PowerShell cmdlets (Set-MpPreference), consistent with adversary activity aimed at bypassing security monitoring.
Detects the systematic disabling or termination of security products and auditing tools on Windows systems, including Microsoft Defender, Sysmon, Filebeat, and WAF logging services. The rule triggers on process execution patterns associated with command-line tampering, service control manager manipulation, registry modifications, and the execution of specific batch scripts designed to impair defenses.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
Detects the creation, deletion, or starting of a Windows service named 'MixedSvc' via sc.exe. This activity is associated with the 'Operation DragonReturn' campaign, where adversaries leverage a service masquerading as legitimate Windows Media Player components to maintain persistence.
Detects the use of the Windows Service Control Manager (sc.exe) to create, start, or delete a service named 'MixedSvc'. The rule includes specific checks for binPath configurations, which can be indicative of persistence or privilege escalation attempts using services.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects attempts to stop, disable, delete, or configure the Sysmon service using standard administrative utilities (sc.exe, taskkill.exe, or PowerShell). Attackers often perform these actions to blind defensive visibility before executing further malicious activity.
Page 2 of 3