Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
260 detections
Filters
Last updated
All Time
Detection languages
111
37
36
21
15
Contributors
72
35
28
28
14
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
223
37
4
2
1
Products / Services
84
73
67
48
34
MITRE Techniques
117
98
85
84
77
CVEs
4
2
1
1
1
IDS Classtypes
6
1
IDS Protocols
7
Detects the execution of various command-line tools (sc, net, powershell, wmic, taskkill, systemctl, launchctl) used to stop or disable system services. This behavior is often associated with adversaries attempting to stop security services, backup agents, or other critical infrastructure for impact, defense evasion, or prior to data destruction.
KQL Query
This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.
This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Detects a malicious teardown sequence involving the 'drvsvc' service being stopped or deleted in the registry, followed by the deletion of the 'C:\Windows\System32\drivers\drv.sys' file within a 15-minute window. This behavior is indicative of a driver redeployment process, often associated with the removal of security-disabling components.
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects the use of PowerShell or administrative command-line tools (net, sc) to enumerate and forcefully stop critical backup, database, and virtualization services. This behavior is commonly observed in ransomware attacks where adversaries disable security-critical or data-hosting services prior to encryption to ensure file locks are released and backups are incapacitated.
This detects a suspicious process pattern where "svchost.exe -> svchost.exe -k DHCPServer" running under the Network Service account.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
Detects attempts to tamper with Windows security services and configurations. The rule identifies PowerShell commands used to add Windows Defender exclusions or disable real-time protection, as well as command-line utilities like sc.exe and net.exe used to stop security, antivirus, or EDR services. This behavior is indicative of defense evasion.
This rule monitors for suspicious activity aimed at disabling or tampering with security software, including antivirus processes and services. It identifies execution of tools named 'AVKiller.exe', the usage of commands like 'taskkill', 'net stop', or 'sc stop' against known security-related processes, and the modification of Windows Defender scheduled tasks to disable security scans.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Detects the use of system utilities (net.exe, net1.exe, taskkill.exe, sc.exe) to stop five or more services identified as security, backup, or database software. This behavior is indicative of an adversary attempting to disable security monitoring and backup recovery tools, a common precursor to ransomware encryption.
Detects attempts to disable or tamper with Microsoft Defender by terminating its processes, stopping its associated services, adding directory exclusions, or modifying registry keys used to control its behavior and security settings.
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
Detects various methods of disabling or tampering with Windows Defender protections, including modifying preferences via PowerShell (Set-MpPreference), stopping the WinDefend service via sc.exe, terminating the antivirus process via taskkill, or modifying Registry keys associated with Defender policies.
Detects attempts to disable or tamper with Microsoft Defender Antivirus settings, services, or processes. This includes the use of Set-MpPreference to change configuration, service control (sc) to stop the WinDefend service, process termination via taskkill, or the execution of known removal scripts like DisableDefender.ps1.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
Page 5 of 13