Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
406
57
14
12
12
Contributors
387
54
19
13
12
Categories
146
108
66
45
35
Platforms
396
33
19
18
13
Products / Services
205
137
62
40
31
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
Detects an appx package deployment that was blocked by the local computer policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Detects WRITE_DAC access to a domain object
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Detects NetNTLM downgrade attack
Detects DCShadow via create new SPN
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Detects possible addition of shadow credentials to an active directory object.
Detects application popup reporting a failure of the Sysmon service
Detects denied requests by Active Directory Certificate Services.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Windows Defender logs when the history of detected infections is deleted.
Detects issues with Windows Defender Real-Time Protection features
Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.
Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs
Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads to the EventLog and then retrieve them later for later use
Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
Detects when a user disables the Windows Firewall via a Profile to help evade defense.
Detect use of X509Enrollment
Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system.
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Page 21 of 24