Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects the use of bcdedit.exe to modify the boot configuration to enable 'safeboot' with 'network' (Safe Mode with Networking). This technique is often used by adversaries to bypass security software that may not load or function correctly in Safe Mode.
Detects processes attempting to read the ntdll.dll file directly from the disk, a technique commonly associated with EDR bypass attempts where adversaries map a fresh copy of the library to overwrite hooked syscall functions (e.g., NtAllocateVirtualMemory/NtWriteVirtualMemory) to evade detection. The rule excludes common, legitimate system processes that may legitimately access this file during startup or normal operation.
Detects the use of PowerShell, pwsh, or cmd to execute the 'Add-MpPreference' command with the '-ExclusionPath' parameter, specifically targeting common directories like Telegram Desktop or specific system directories. This activity suggests an attempt to bypass security scanning by excluding known malicious locations or folders from Microsoft Defender's real-time monitoring.
Detects command-line activity associated with Monkey ransomware, specifically attempts to bypass AMSI (patching AmsiScanBuffer, targeting AmsiUtils), disable ETW (Event Tracing for Windows) monitoring, and add Microsoft Defender exclusions to evade detection prior to encryption.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
This rule detects potential attempts to tamper with or bypass Windows Defender by monitoring for files or processes named 'ShieldCrash' occurring in close temporal proximity to the creation or modification of files within Windows Defender's shadow or scan directories (BaseNamedObjects\Restricted\WD_SHADOW_ or WD_SCAN). This behavior is often associated with malware attempting to evade security detection.
Detects the deletion of the registry key responsible for Chrome extension integrity verification (PreferenceMACs). Deleting this key allows an adversary to tamper with installed Chrome extensions without triggering security warnings. This activity has been observed in the Rapuncel campaign.
Detects the deletion of the registry key responsible for Chrome extension integrity verification (PreferenceMACs). Deleting this key allows an adversary to tamper with installed Chrome extensions without triggering security warnings. This activity has been observed in the Rapuncel campaign.
This rule detects the potential bypassing of Protected Process Light (PPL) in Windows, characterized by kernel-mode driver activity (such as ObOpenObjectByPointer) correlated with the mass termination of security-related processes (e.g., Defender, CrowdStrike, SentinelOne). The correlation between driver-level object handle manipulation and the termination of protected security binaries is a strong indicator of an adversary attempting to disable EDR/AV protections via kernel exploitation or driver abuse.
Detects the installation and loading of a suspicious driver named 'NvFsFilter' (nvfsflt64.sys), accompanied by registry persistence and suspicious process termination events. This pattern is characteristic of a 'kill-loop' persistence mechanism where malicious drivers or services repeatedly terminate security agents (AV/EDR) to maintain a persistent foothold on the endpoint.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects the use of PowerShell to add Microsoft Defender exclusions (paths or extensions) where the process was initiated by or involves LockAppHost.exe. This behavior is indicative of an attempt to bypass security protections by excluding malicious artifacts from scanning.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
Detects unexpected crashes of major security software agents (e.g., Antivirus, EDR) that are not associated with authorized vendor update or installation activities, potentially indicating tampering or exploitation attempts to disable security controls.
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
Page 16 of 36