Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
406
57
14
12
12
Contributors
387
54
19
13
12
Categories
146
108
66
45
35
Platforms
396
33
19
18
13
Products / Services
205
137
62
40
31
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Detects potential persistence activity via outlook home page.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Detects disabling of the Windows Defender virus scanning feature
Detects suspicious changes to the Windows Defender configuration
Detects registry modifications that disable Privacy Settings Experience
Detect set EnableFirewall to 0 to disable the Windows firewall
Detect set DisallowRun to 1 to prevent user running specific computer program
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
Detects potential registry persistence technique using the Event Viewer "Events.asp" technique
Detects the Setting of Windows Defender Exclusions
Detects tampering of RDP Terminal Service/Server sensitive settings.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Page 24 of 24