Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects when third-party application access restrictions are disabled for a GitHub organization.
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Detects suspicious changes to the Windows Defender configuration
Detects registry modifications that disable Privacy Settings Experience
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detects the Setting of Windows Defender Exclusions
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Yara rule that detects ShadowCryptor ransomware.
Yara rule that detects Clop ransomware.
Page 36 of 36