Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
406
57
14
12
12
Contributors
387
54
19
13
12
Categories
146
108
66
45
35
Platforms
396
33
19
18
13
Products / Services
205
137
62
40
31
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.
Potential threat actor tampering with Sysmon manifest and eventually disabling it
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Detects attempts to disable the Windows Firewall using PowerShell
Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility
Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection
Detects the import of the specified file to the registry with regedit.exe.
Detects the import of a alternate datastream to the registry with regedit.exe.
Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.
ShimCache Flush
Sigma
Detects actions that clear the local ShimCache and remove forensic evidence
This rule detects the execution of Run Once task as configured in the registry
Detects changes to environment variables related to ETW logging via the CommandLine.
This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.
This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.
Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon
Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
Detects potential malicious modification of the property value of IsCredGuardEnabled from
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system.
This is usually used with UseLogonCredential to manipulate the caching credentials.
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system.
This is usually used with UseLogonCredential to manipulate the caching credentials.
Detects the presence of a registry key created during Azorult execution
Page 18 of 24