Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.
Detects execution of "reg.exe" to disable security services such as Windows Defender.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects NetNTLM downgrade attack
Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry
Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections
Detects when the "index" value of a scheduled task is modified from the registry
Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)
Detects when a user bypasses the push protection on a secret detected by secret scanning.
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Detects the modification of the findings on SecurityHub.
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
Page 32 of 36