Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects suspicious processes attempting to open security-critical DLLs like amsi.dll or ntdll.dll with potential write or execute access. This behavior is often associated with runtime patching techniques used to disable or evade AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) monitoring, which are common defensive evasion tactics.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects the deletion of registry keys or values associated with Google Chrome's extension settings preferences. This activity may indicate an attempt to disable installed extensions or tamper with browser security configurations.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule monitors for suspicious process execution patterns that suggest system tampering, security tool evasion, or data concealment. It detects activities such as clearing event logs, modifying Windows Defender preferences (exclusions/real-time monitoring), creating suspicious scheduled tasks, deleting volume shadow copies, and using PowerShell for credential or system state manipulation.
This rule monitors for a collection of adversarial behaviors on Windows systems, including persistence mechanisms via scheduled tasks and registry run keys, tampering with security services (VSS, Windows Defender), credential harvesting attempts (LSASS memory), log and history clearing, and external network communication to known IP geolocation services.
Detects the loading of amsi.dll or clr.dll into the charmap.exe process. Adversaries often inject malicious code into legitimate, system-native processes like charmap.exe to bypass detection and perform in-memory patching of security controls, such as disabling AMSI (Antimalware Scan Interface).
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
Detects the termination of 'wscript.exe' using 'taskkill.exe' or PowerShell 'Stop-Process'. This behavior is commonly used by malicious loaders to stop script-based execution after a payload has been staged or executed to minimize forensic artifacts and potential detection by defenders monitoring long-running processes.
Detects the use of PowerShell, pwsh, or cmd to execute the 'Add-MpPreference' command with the '-ExclusionPath' parameter, specifically targeting common directories like Telegram Desktop or specific system directories. This activity suggests an attempt to bypass security scanning by excluding known malicious locations or folders from Microsoft Defender's real-time monitoring.
Detects the use of PowerShell, pwsh, or cmd to execute the 'Add-MpPreference' command with the '-ExclusionPath' parameter, specifically targeting common directories like Telegram Desktop or specific system directories. This activity suggests an attempt to bypass security scanning by excluding known malicious locations or folders from Microsoft Defender's real-time monitoring.
Detects the use of PowerShell, pwsh, or cmd to execute the 'Add-MpPreference' command with the '-ExclusionPath' parameter, specifically targeting common directories like Telegram Desktop or specific system directories. This activity suggests an attempt to bypass security scanning by excluding known malicious locations or folders from Microsoft Defender's real-time monitoring.
This rule detects the process 'ShieldCrash.exe' accessing or interacting with the Windows ELAM (Early Launch Anti-Malware) configuration directory. ELAM drivers are critical components for secure boot and early malware detection; unauthorized access or manipulation by unknown processes may indicate an attempt to tamper with security tools or evade endpoint protection.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the execution of PowerShell commands containing indicators of AMSI or ETW unhooking (e.g., references to amsi.dll, AmsiScanBuffer, EtwEventWrite, or VirtualProtect). This activity is commonly associated with attackers attempting to bypass endpoint security telemetry and antimalware scanning mechanisms prior to executing malicious payloads.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
This rule detects attempts by an IIS worker process (w3wp.exe) to tamper with or disable the Antimalware Scan Interface (AMSI) by monitoring for specific non-standard provider registrations or scan buffer patching events. This activity often indicates an attacker attempting to bypass security scanning within a web-based application process.
Page 15 of 36