Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
This rule detects attempts to disable or tamper with Microsoft Defender security features by monitoring for unauthorized modifications to specific registry keys (DisableAntiSpyware, DisableRealtimeMonitoring, or the WinDefend service start type) in conjunction with related process execution activity (e.g., PowerShell, cmd, reg, or MpCmdRun) that includes keywords associated with defender configuration changes.
This rule detects modifications to Microsoft Defender antivirus exclusions. Adversaries often add paths or files to the exclusion list to prevent the detection of malicious tools or staging folders during cyberattacks. The rule monitors both command-line execution of PowerShell (Add-MpPreference/Set-MpPreference) and direct registry modifications related to Windows Defender paths.
Detects the use of the Add-MpPreference cmdlet with -ExclusionPath, or processes spawned by CRUDEEXCLUDE.exe, which are associated with configuring Microsoft Defender exclusion paths. This is often used by adversaries to evade detection by excluding malicious files or directories from antivirus scanning.
This rule detects a suspicious sequence of events where a process related to Electron (a framework often used for cross-platform desktop applications) executes a hidden, obfuscated PowerShell command, followed by a subsequent PowerShell command to modify Microsoft Defender settings by adding an exclusion path for the 'AppData' directory within 10 minutes of the first process.
Detects the execution of RatHat, a Go-based Android native daemon masquerading as 'liblocal-service.so'. The rule identifies the malware's use of ADB-derived shell commands to bypass Android Doze mode, prioritize background execution, and tamper with installed applications via pm (package manager) commands.
Detects execution of PowerShell scripts attempting to modify Windows Defender settings by adding directory exclusions (including the C:\ drive) via cmdlets like Add-MpPreference, Set-MpPreference, or WMI/CIM methods, often followed by a forced Group Policy refresh. This pattern is associated with malicious staging activity, including malware loaders like LausivLoader.
Detects attempts to patch ETW (Event Tracing for Windows) functions such as EtwEventWrite within the memory space of PowerShell or PWSH processes. This is a common technique used by attackers to suppress telemetry and evade security monitoring tools, often associated with bypassing AMSI/ETW logging mechanisms.
Detects attempts to patch ETW (Event Tracing for Windows) functions such as EtwEventWrite within the memory space of PowerShell or PWSH processes. This is a common technique used by attackers to suppress telemetry and evade security monitoring tools, often associated with bypassing AMSI/ETW logging mechanisms.
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI) via direct memory modification or through script command-line arguments. The rule monitors DeviceEvents for AMSI-specific events (e.g., buffer patching, provider tampering) and looks for common PowerShell and scripting engine command-line patterns indicative of AMSI bypass techniques.
Detects the creation of a scheduled task configured to run under the SYSTEM account that executes a command to add a Windows Defender exclusion using Add-MpPreference. This technique is often used to ensure persistence of security exclusions by re-applying them automatically with high privileges, even if an interactive user attempts to remove them.
This rule detects two potentially malicious activities: the addition of exclusions to Windows Defender using reg.exe, which can be used to hide malicious files from security scanning, and the forceful update of Group Policy using gpupdate.exe with /force and /wait:0, which can be used to propagate malicious policy changes or force re-application of settings.
Detects attempts to modify Microsoft Defender settings, such as adding file path exclusions via PowerShell, Registry manipulation, or Scheduled Tasks, as well as disabling Tamper Protection. These actions are commonly used by attackers to evade security monitoring by hiding malicious files or disabling protective features.
Detects PowerShell execution commands attempting to disable Antimalware Scan Interface (AMSI) by reflectively accessing System.Management.Automation.AmsiUtils. This is a common technique used by attackers to execute malicious scripts while avoiding detection by security software.
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
This rule detects the addition of Microsoft Defender exclusions via PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry key modifications, occurring within two hours of a new autorun persistence entry being created on the same device. This behavior is indicative of a persistence-then-evasion sequence often used to ensure malicious tools remain undetected.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects pre-encryption defensive measures employed by the Monkey ransomware C++ variant. This rule triggers on behaviors including Microsoft Defender exclusion management, disabling of AMSI or ETW components, manipulation of system security settings via registry, and attempts to clear PowerShell or command-line history to facilitate anti-forensic evasion.
Detects evidence of anti-forensic activities associated with the SparroWocky toolset. The rule monitors for the removal of the 'ProcAuditManager' service, deletion of the 'SnapCart' registry key, and the execution of a self-deleting batch script used to remove forensic artifacts.
Page 12 of 36