Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects disabling Windows Defender PUA protection
Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Detects tamper attempts to sophos av functionality via registry key modification
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
Detects Bitbucket global SSH access configuration changes.
Detects changes to the bitbucket audit log configuration.
Detects when a secret scanning allowlist rule is added for projects.
Detects when a repository is exempted from secret scanning feature.
Detect changes in auditd configuration files
Turn off logging locally or remote
Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Detects attempts to disable the Windows Firewall using PowerShell
Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection
Detects changes to environment variables related to ETW logging via the CommandLine.
This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.
This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.
Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon
Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
Page 34 of 36