Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,670
9,758
6,693
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects the presence of known SHA256 hashes associated with the 'ccrtc' planter PowerShell scripts and C2 SDK JavaScript components. These files were identified as being dropped into 'C:\Windows\Temp' during the STAC4924 webshell intrusion campaign.
This rule detects a sequence of events characteristic of the x47.c persistence pattern. It monitors for the creation of persistence mechanisms via Windows Registry Run keys or scheduled tasks, followed by the addition of Windows Defender exclusions using PowerShell within a 30-minute window on the same device.
Detects a suspicious burst of commands commonly used to disable security services, antivirus, or backup agents on a single host. The rule monitors for a high frequency of taskkill, net stop, sc stop, or PowerShell Stop-Service operations targeting a predefined list of sensitive security software process and service names within a short timeframe, which is a common precursor to ransomware encryption.
Detects modifications to Windows Registry keys responsible for Windows Defender settings, specifically attempts to disable real-time protection, behavior monitoring, scan on access, or tamper protection features by setting specific registry values to 1.
Detects attempts to disable, modify, or stop security software and endpoint protection services. The rule monitors for registry changes to Windows Defender settings, manual service management commands (sc, net) targeting security processes, and PowerShell execution using 'Set-MpPreference' to disable protection features.
Detects DB/DLL files masquerading as legitimate components that embed an XOR-encrypted PE (SectopRAT payload) or the sdkcra.dll loader export used in the FrameworkBase.dll tampered-IAT chain
Detects evidence of potential adversarial interference with Windows Defender updates and MRT.exe (Malicious Software Removal Tool). The rule correlates high volumes of temporary file creation in user directories with unauthorized access to MRT.exe by third-party processes and repeated Windows Defender update failures, indicating a potential attempt to disrupt endpoint security operations.
Detects a fake ClaudeDesktop.exe installer / tampered libcef.dll sideload chain deploying the SectopRAT .NET RAT, requiring multiple corroborating indicators and a PE anomaly consistent with DLL sideloading rather than a single generic string
Detects the first-stage loader DLL associated with the NeedyMantis actor, which masquerades as the WinSparkle.dll component used in Poedit software. This rule uses a specific SHA256 file hash to identify this malicious component.
Detects unpacked Sauron Loader malware samples by identifying specific embedded configuration artifacts, including a fixed magic header value (0xbaadf00d), internal marker strings, and associated test identifiers for group and build IDs.
Detects multiple methods of tampering with Windows Defender security controls within a short time window. This includes PowerShell commands to modify Defender preferences (e.g., disabling Real-time Monitoring or adding exclusions), modifications to Defender-related registry keys, and attempts to stop or disable the WinDefend service.
Detects the use of PowerShell to add an exclusion to Microsoft Defender. The detection looks for common obfuscation flags (Hidden, NonI, NoP, Bypass) in the command line and targets the MicrosoftEdgeUpdateCore executable or DLL for exclusion, which is a common persistence or evasion technique. It excludes parent processes known for administrative activity to reduce noise.
Matches published SHA-256 hashes for the Kothamine Injector and Agent DLL, which drop MicrosoftEdgeUpdateCore.exe/.dll and inject into explorer.exe. Exact full-file SHA-256 match only, no fuzzy or partial matching, no additional PE structural checks.
Detects attempts to disable security services (Windows Defender, EDR agents), modify audit policies via auditpol, or stop/clear the Windows Event Log service. This behavior is a common precursor to post-compromise activity intended to blind defenders and conceal malicious actions.
Matches distinctive DragonForce TURN/MQTT campaign artifact filenames only when combined with byte-level markers unique to the malware (PE structure, TURN/MQTT C2 infrastructure strings, or the loader's pipe-caret-pipe thread-trigger byte pattern), to avoid false positives on unrelated benign files sharing these names.
Matches distinctive DragonForce TURN/MQTT campaign artifact filenames only when combined with byte-level markers unique to the malware (PE structure, TURN/MQTT C2 infrastructure strings, or the loader's pipe-caret-pipe thread-trigger byte pattern), to avoid false positives on unrelated benign files sharing these names.
Detects the use of PowerShell to modify Windows Defender settings (e.g., disabling real-time monitoring, adding exclusions, or stopping services) using the Set-MpPreference cmdlet or service control commands. This technique is frequently utilized by ransomware actors, such as the ALPHV/BlackCat group, to neutralize security protections prior to executing malicious payloads.
Detects 2CLoader samples containing the embedded config magic bytes alongside rolling-XOR, AES-GCM, and sha256-seed-derived key material used in its payload decryption chain
Detects 2CLoader samples containing the embedded config magic bytes alongside rolling-XOR, AES-GCM, and sha256-seed-derived key material used in its payload decryption chain
Detects 2CLoader samples containing the embedded config magic bytes alongside rolling-XOR, AES-GCM, and sha256-seed-derived key material used in its payload decryption chain
Detects the use of the sc.exe command-line utility to stop or disable the Microsoft Defender Antivirus service (WinDefend). This activity is often associated with ransomware, such as Nova ransomware, to bypass security controls prior to malicious encryption or data destruction.
Page 2 of 43