Techniques › T1685 › T1685.003
T1685.003 Modify or Spoof Tool UI
defense impairment — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1685.003
0
KEV CVEs mapped here
<p>Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response.</p><p>Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system.</p><p>This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity.</p><p>For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0311 Detection for Spoofing Tool UI across OS Platforms v1.0
AN0868 WindowsDetection of inconsistencies between reported sensor health and actual process/service state. For example, Windows Defender tray icon/UI showing healthy status while corresponding Defender services (WinDefend, MsMpEng) are stopped or disabled. Correlates process creation events with missing or terminated security processes and spoofed health events.Tunable:
ServiceNameListFakeUIProcessPatternsAN0869 LinuxMonitoring for discrepancies between system daemon/service state and reported health messages (e.g., syslog shows AV/IDS daemon stopped, but spoofed messages claim it is still running). Detects userland processes impersonating AV/IDS command-line outputs or modifying log forwarding configurations.auditd:SYSCALLexecve: Execution of binaries/scripts presenting false health messages for security daemons→ DC0032 Process Creationlinux:syslogService stop or disable messages for security tools not reflected in SIEM alerts→ DC0018 Host StatusTunable:SecurityDaemonListAN0870 macOSDetection of fake or spoofed macOS Security & Privacy GUIs showing healthy status after XProtect, Gatekeeper, or AV processes are disabled. Correlates user-space UI process creation with terminated or missing security daemons.macos:unifiedlogExecution of processes mimicking Apple Security & Privacy GUIs→ DC0032 Process Creationmacos:unifiedlogTermination or disabling of XProtect, Gatekeeper, or third-party AV daemons→ DC0018 Host StatusTunable:TrustedDaemonList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1685.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1685) 164
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: @Kostastsale
· 2023-08-22 · logsource: product=windows category=process_creation · 023c654f-8f16-44d9-bb2b-00ff36a62af9
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Author: Muhammad Faisal (@faisalusuf)
· 2024-03-07 · logsource: product=github service=audit · 02cf536a-cf21-4876-8842-4159c8aee3cc
Detects when a user bypasses the push protection on a secret detected by secret scanning.
Author: frack113
· 2022-10-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b
Detects registry modifications that disable Privacy Settings Experience
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-01 (modified 2023-02-04) · logsource: product=windows category=process_creation · 05b2aa93-1210-42c8-8d9a-2fcc13b284f5
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-05 · logsource: product=windows category=process_creation · 07e3cb2c-0608-410d-be4b-1511cb1a0448
Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet
Author: Christian Burkard (Nextron Systems)
· 2021-08-04 (modified 2023-11-28) · logsource: product=windows category=process_access · 09706624-b7f6-455d-9d02-adee024cee1d
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Author: AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel
· 2022-08-01 (modified 2024-10-07) · logsource: product=windows category=registry_set · 0eb46774-f1ab-4a74-8238-1155855f2263
Detects when attackers or tools disable Windows Defender functionalities via the Windows registry
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-28 (modified 2022-11-25) · logsource: product=windows category=ps_script · 115fdba9-f017-42e6-84cf-d5573bf2ddf8
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Author: Andreas Braathen (mnemonic.io)
· 2025-01-30 · logsource: product=windows category=file_event · 121b25f7-b9d6-4b37-afa0-cba317ec52f3
Attackers can craft a custom Windows Defender Application Control (WDAC) policy that blocks Endpoint Detection and Response (EDR) components while allowing their own malicious code. The policy is placed in the privileged Windows Code Integrity folder (C:\Windows\System32\CodeIntegrity\). Upon reboot, the policy prevents EDR drivers from loading, effectively bypassing security measures and may further enable undetected lateral movement within an Active Directory environment.
Author: Tim Rauch, Elastic (idea)
· 2022-09-14 (modified 2023-02-13) · logsource: product=windows category=process_creation · 12f6b752-042d-483e-bf9c-915a6d06ad75
Detects attempts to disable the Windows Firewall using PowerShell
Author: Christian Burkard (Nextron Systems)
· 2021-07-06 (modified 2022-12-06) · logsource: product=windows service=windefend · 1321dc4e-a1fe-481d-a016-52c45f0c8b4f
Detects the Setting of Windows Defender Exclusions
Author: frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
· 2022-01-16 (modified 2024-01-02) · logsource: product=windows category=ps_script · 14c71865-6cd3-44ae-adaa-1db923fae5f2
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · 160d2780-31f7-4922-8b3a-efce30e63e96
Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 16ab6143-510a-44e2-a615-bdb80b8317fc
Detects Bitbucket global SSH access configuration changes.
Author: Florian Roth (Nextron Systems)
· 2021-04-29 (modified 2022-05-12) · logsource: product=windows category=process_creation · 17769c90-230e-488b-a463-e05c08e9d48f
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets
Author: Nasreddine Bencherchali (Nextron Systems), @Kostastsale
· 2024-08-23 · logsource: product=windows category=registry_set · 17e53739-a1fc-4a62-b1b9-87711c2d5e44
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-07-10 · logsource: product=aws service=cloudtrail · 1c722651-254a-4b04-a9f4-99b62a2d0a1f
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
Author: Matt Anderson (Huntress)
· 2025-07-11 · logsource: product=windows category=process_creation · 1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e
Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9').
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level.
An attacker might use this technique via the command line to bypass defenses before executing payloads.
Author: Florian Roth (Nextron Systems)
· 2022-03-03 (modified 2024-01-02) · logsource: product=windows category=process_creation · 1ec65a5f-9473-4f12-97da-622044d6df21
Detects requests to disable Microsoft Defender features using PowerShell commands
Author: Jason (https://github.com/0xbcf)
· 2025-09-23 (modified 2025-11-23) · logsource: product=windows category=process_creation · 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).
This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.
Distinct command line patterns help identify the specific tool:
- WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
- EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine
Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
Author: Frack113
· 2025-10-23 · logsource: product=windows category=registry_set · 1f1d8209-636e-4c6c-a137-781cca8b82f9
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-01-26 · logsource: product=windows category=process_creation · 22154f0e-5132-4a54-aa78-cc62f6def531
Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE.
The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers.
Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors
to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 225d8b09-e714-479c-a0e4-55e6f29adf35
Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-05 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 272e55a4-9e6b-4211-acb6-78f51f0b1b40
Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
Author: Markus Neis, @Kostastsale
· 2018-08-17 (modified 2023-02-03) · logsource: product=windows category=process_creation · 30edb182-aa75-42c0-b0a9-e998bb29067c
Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
Author: @kostastsale, Nasreddine Bencherchali (Nextron Systems)
· 2023-11-05 (modified 2024-08-16) · logsource: product=windows category=registry_set · 31e124fb-5dc4-42a0-83b3-44a69c77b271
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
Author: Ján Trenčanský, frack113
· 2020-07-28 (modified 2023-11-22) · logsource: product=windows service=windefend · 360a1340-398a-46b6-8d06-99b905dc69d2
Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.
Author: Milad Cheraghi
· 2025-10-18 · logsource: product=linux category=process_creation · 36388120-b3f1-4ce9-b50b-280d9a7f4c04
Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.
This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.
Author: Luc Génaux
· 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 · logsource: product=windows category=process_access · 387df17d-3b04-448f-8669-9e7fd5e5fd8c
Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.
This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.
Author: Muhammad Faisal (@faisalusuf)
· 2024-03-07 (modified 2024-07-19) · logsource: product=github service=audit · 3883d9a0-fd0f-440f-afbb-445a2a799bb8
Detects if the secret scanning feature is disabled for an enterprise or repository.
Author: Cedric Maurugeon
· 2023-09-04 · logsource: product=linux category=process_creation · 38eb1dbb-011f-40b1-a126-cf03a0210563
Detects changes to the ESXi syslog configuration via "esxcli"
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
· 2019-04-08 (modified 2026-06-29) · logsource: product=windows category=file_event · 3da70954-0f2c-4103-adff-b7440368f50e
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-05-02 (modified 2022-12-09) · logsource: product=windows category=process_creation · 41421f44-58f9-455d-838a-c398859841d4
Detects changes to environment variables related to ETW logging via the CommandLine.
This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Author: frack113
· 2021-06-07 (modified 2025-10-07) · logsource: product=windows category=registry_delete · 41d1058a-aea7-4952-9293-29eaaf516465
Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 42205c73-75c8-4a63-9db1-e3782e06fda0
Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 42ccce6d-7bd3-4930-95cd-e4d83fa94a30
Detects when a secret scanning allowlist rule is added for projects.
Author: frack113
· 2022-01-16 (modified 2022-08-26) · logsource: product=windows category=process_creation · 43e32da2-fdd0-4156-90de-50dfd62636f9
Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Author: @Kostastsale, TheDFIRReport
· 2022-05-09 (modified 2025-04-16) · logsource: product=windows category=process_creation · 44e24481-6202-4c62-9127-5a0ae8e3fe3d
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
· 2022-03-22 (modified 2025-06-04) · logsource: product=windows category=process_creation · 452bce90-6fb0-43cc-97a5-affc283139b3
Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection
Author: @BarryShooshooga
· 2019-10-26 (modified 2023-11-11) · logsource: product=windows service=security · 46a68649-f218-4f86-aea1-16a759d81820
Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.
Author: frack113
· 2022-02-13 (modified 2023-02-04) · logsource: product=windows category=process_creation · 48917adc-a28e-4f5d-b729-11e75da8941f
Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.
Author: B.Talebi
· 2022-07-28 (modified 2024-03-25) · logsource: product=windows category=registry_set · 4916a35e-bfc4-47d0-8e25-a003d7067061
Detects changes in Sysmon driver altitude value.
If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-13 (modified 2025-10-07) · logsource: product=windows category=process_creation · 4931188c-178e-4ee7-a348-39e8a7a56821
Detect filter driver unloading activity via fltmc.exe
Author: Bhabesh Raj, Nasreddine Bencherchali
· 2021-07-05 (modified 2022-12-06) · logsource: product=windows service=windefend · 49e5bc24-8b86-49f1-b743-535f332c2856
Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
Author: Ilya Krestinichev, Florian Roth (Nextron Systems)
· 2022-09-13 · logsource: product=windows category=process_creation · 4a6713f6-3331-11ed-a261-0242ac120002
Detects one of the possible scenarios for disabling Symantec Endpoint Protection.
Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism.
As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-23 (modified 2026-06-29) · logsource: product=windows category=process_creation · 4beb6ae0-f85b-41e2-8f18-8668abc8af78
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses
Author: X__Junior (Nextron Systems)
· 2023-11-03 · logsource: product=windows category=registry_set · 4d431012-2ab5-4db7-a84e-b29809da2172
Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.
Author: Kirill Kiryanov, oscd.community
· 2019-10-23 (modified 2023-02-13) · logsource: product=windows category=process_creation · 4d7cda18-1b12-4e52-b45c-d28653210df8
Detects possible Sysmon filter driver unloaded via fltmc.exe
Author: Tim Shelton
· 2022-04-26 (modified 2024-01-17) · logsource: product=windows service=system · 4d7f1827-1637-4def-8d8a-fd254f9454df
Detects application popup reporting a failure of the Sysmon service
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-09 (modified 2023-08-17) · logsource: product=windows category=registry_set · 4f281b83-0200-4b34-bf35-d24687ea57c2
Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)
Author: frack113
· 2022-12-11 (modified 2023-02-14) · logsource: product=windows category=process_creation · 51cbac1e-eee3-4a90-b1b7-358efb81fa0a
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-26 (modified 2025-10-25) · logsource: product=windows category=registry_delete · 526cc8bc-1cdc-48ad-8b26-f19bff969cec
Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"
Author: Florian Roth (Nextron Systems)
· 2017-05-09 (modified 2023-04-14) · logsource: product=windows service=application · 545a5da6-f103-4919-a519-e9aec1026ee4
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-07-10 · logsource: product=aws service=cloudtrail · 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
Author: Matt Anderson (Huntress)
· 2025-07-11 · logsource: product=windows category=registry_event · 5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f
Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,
allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-26 (modified 2023-08-17) · logsource: product=windows category=registry_set · 5b16df71-8615-4f7f-ac9b-6c43c0509e61
Detects when the "index" value of a scheduled task is modified from the registry
Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
Author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim
· 2021-07-14 (modified 2023-06-05) · logsource: product=windows category=process_creation · 5e95028c-5229-4214-afae-d653d573d0ec
Detects execution of "reg.exe" to disable security services such as Windows Defender.
Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-01-26 · logsource: product=windows category=process_creation · 6225c53a-a96e-4235-b28f-8d7997cd96eb
Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe.
HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.
Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-04 · logsource: product=windows category=process_creation · 62b20d44-1546-4e61-afce-8e175eb9473c
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
Author: Tuan Le (NCSGroup)
· 2023-03-16 (modified 2024-12-12) · logsource: product=linux category=process_creation · 64c41342-6b27-523b-5d3f-c265f3efcdb3
Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.
Author: Ján Trenčanský, frack113
· 2020-07-28 (modified 2023-11-22) · logsource: product=windows service=windefend · 686c0b4b-9dd3-4847-9077-d6c1bbe36fcb
Detects disabling of the Windows Defender virus scanning feature
Author: frack113
· 2022-01-12 (modified 2026-06-29) · logsource: product=windows category=process_creation · 6a5f68d1-c4b5-46b9-94ee-5324892ea939
Detects the removal of Sysmon, which could be a potential attempt at defense evasion
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 6aa12161-235a-4dfb-9c74-fe08df8d8da1
Detects changes to the bitbucket audit log configuration.
Author: Ján Trenčanský, frack113
· 2020-07-28 (modified 2024-07-02) · logsource: product=windows service=system · 6c0a7755-6d31-44fa-80e1-133e57752680
Detects when the "Windows Defender Threat Protection" service is disabled.
Author: Florian Roth (Nextron Systems)
· 2017-05-09 (modified 2023-04-14) · logsource: product=windows service=application · 6c82cf5c-090d-4d57-9188-533577631108
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Author: faloker
· 2020-02-11 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-26 · logsource: product=windows category=registry_set · 73921b9c-cafd-4446-b0c6-fdb0ace42bc0
Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
Author: Sreeman
· 2021-06-11 (modified 2024-01-18) · logsource: product=windows category=process_creation · 75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13
Detects applications trying to modify the registry in order to disable any write-protect property for storage devices.
This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.
Author: pH-T (Nextron Systems)
· 2023-04-17 (modified 2024-11-23) · logsource: product=windows category=process_creation · 7a4d9232-92fc-404d-8ce1-4c92e7caf539
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Author: Markus Neis, Swisscom
· 2020-06-18 (modified 2023-03-10) · logsource: product=windows category=process_creation · 7b544661-69fc-419f-9a59-82ccc328f205
Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
· 2022-06-15 (modified 2023-08-17) · logsource: product=windows category=registry_set · 7d995e63-ec83-4aa3-89d5-8a17b5c87c86
Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-25 · logsource: product=windows category=process_creation · 7dbbcac2-57a0-45ac-b306-ff30a8bd2981
Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell.
AMSI provides a generic interface for applications and services to integrate with antimalware products.
Adversaries may disable AMSI to evade detection of malicious scripts and code execution.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-07-05 · logsource: product=windows category=registry_set · 7f2954d2-99c2-4d42-a065-ca36740f187b
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-06 (modified 2023-11-24) · logsource: product=windows service=windefend · 801bd44f-ceed-4eb6-887c-11544633c0aa
Detects suspicious changes to the Windows Defender configuration
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-01-30 (modified 2025-12-15) · logsource: product=windows category=process_creation · 847d5ff3-8a31-4737-a970-aeae8fe21765
Detects uninstallation or termination of security products using the WMIC utility
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-01 (modified 2023-03-04) · logsource: product=windows category=process_creation · 85c312b7-f44d-4a51-a024-d671c40b49fc
Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"
Author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
· 2026-01-02 · logsource: product=windows category=process_creation · 85f520e7-6f5e-43ca-874c-222e5bf9c0de
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.
This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.
This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-09 (modified 2026-06-29) · logsource: product=windows category=process_creation · 87911521-7098-470b-a459-9a57fc80bdfd
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
Detects the loading of dbgcore.dll or dbghelp.dll by WerFaultSecure.exe, which has been observed in EDR-Freeze attacks to suspend processes and evade detection.
However, this behavior has also been observed during normal software installations, so further investigation is required to confirm malicious activity.
When threat hunting, look for this activity in conjunction with other suspicious processes starting, network connections, or file modifications that occur shortly after the DLL load.
Pay special attention to timing - if other malicious activities occur during or immediately after this library loading, it may indicate EDR evasion attempts.
Also correlate with any EDR/AV process suspension events or gaps in security monitoring during the timeframe.
Author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati
· 2023-03-14 (modified 2024-07-05) · logsource: product=windows category=registry_set · 8b7273a4-ba5d-4d8a-b04f-11f2900d043a
Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel
Author: Austin Songer @austinsonger
· 2021-08-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · 8ffc5407-52e3-478f-9596-0a7371eafe13
Detects disabling Windows Defender PUA protection
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-09 (modified 2023-08-17) · logsource: product=windows category=registry_set · 90f342e1-1aaa-4e43-b092-39fda57ed11e
Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-06 · logsource: product=windows service=windefend · 91903aba-1088-42ee-b680-d6d94fe002b0
Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-04 (modified 2023-05-09) · logsource: product=windows category=process_creation · 92a974db-ab84-457f-9ec0-55db83d7a825
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Author: Austin Songer @austinsonger
· 2021-08-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · 93d298a1-d28f-47f1-a468-d971e7796679
Detects disabling Windows Defender Tamper Protection
Author: frack113
· 2021-07-07 (modified 2023-07-18) · logsource: product=windows category=process_creation · 9719a8aa-401c-41af-8108-ced7ec9cd75c
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files
Author: Mikhail Larin, oscd.community
· 2019-10-25 (modified 2021-11-27) · logsource: product=linux service=auditd · 977ef627-4539-4875-adf4-ed8f780c4922
Detect changes in auditd configuration files
Author: Thodoris Polyzos (@SmoothDeploy)
· 2024-01-29 (modified 2024-01-30) · logsource: product=windows service=security · 98054878-5eab-434c-85d4-72d4e5a3361b
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Author: frack113
· 2022-09-10 · logsource: product=windows category=ps_script · 99c4658d-2c5e-4d87-828d-7c066ca537c3
Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
Author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
· 2026-04-17 · logsource: product=windows category=pipe_created · 9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b
Detects the creation of a named pipe with the hardcoded name "REDSUN".
The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain.
RedSun creates the pipe as \\??\pipe\REDSUN.
The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM.
Presence of this pipe name indicates active or recent RedSun execution.
Author: X__Junior (Nextron Systems)
· 2023-11-21 · logsource: product=windows category=registry_set · 9d8f9bb8-01af-4e15-a3a2-349071530530
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9e8f6035-88bf-4a63-96b6-b17c0508257e
Turn off logging locally or remote
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 9f4662ac-17ca-43aa-8f12-5d7b989d0101
Detects tamper attempts to sophos av functionality via registry key modification
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 · logsource: product=windows category=process_access · 9f5c1d59-33be-4e60-bcab-85d2f566effd
Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace.
These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,
dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-10-24 · logsource: product=windows category=registry_event · 9f9f92ba-5300-43a4-b435-87d1ee571688
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability
Author: Matt Anderson (Huntress)
· 2025-07-09 · logsource: product=windows category=process_creation · a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events.
By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events
from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
Author: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
· 2019-03-22 (modified 2022-06-28) · logsource: product=windows category=process_creation · a238b5d0-ce2d-4414-a676-7a531b3d13d6
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Author: Florian Roth (Nextron Systems)
· 2021-01-21 (modified 2022-10-09) · logsource: product=windows category=process_creation · a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc
Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-29 (modified 2023-02-04) · logsource: product=windows category=process_creation · a34f79a3-8e5f-4cc3-b765-de00695452c2
Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-05 (modified 2022-12-06) · logsource: product=windows service=windefend · a3ab73f1-bd46-4319-8f06-4b20d0617886
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-06-05 (modified 2022-12-20) · logsource: product=windows service=security · a4c90ea1-2634-4ca0-adbb-35eae169b6fc
Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-06-08 (modified 2023-08-17) · logsource: product=windows category=registry_set · a5c7a43f-6009-4a8c-80c5-32abf1c53ecc
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Author: Sittikorn S
· 2021-06-28 · logsource: product=aws service=cloudtrail · a607e1fe-74bf-4440-a3ec-b059b9103157
Detects the modification of the findings on SecurityHub.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-17 · logsource: product=windows service=windefend · a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c
Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe
dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present.
This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based
AV bypass/privilege escalation tool.
RedSun works as follows:
1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\
2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger
a Defender scan and remediation attempt
3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file
4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open
5. During the oplock break window, RedSun swaps the mount point (junction) to redirect
\\?\C:\Windows\System32 to the attacker-controlled temp path
6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges
Author: ok @securonix invrep-de, oscd.community, frack113
· 2020-10-12 (modified 2022-11-18) · logsource: product=windows category=process_creation · a7ee1722-c3c5-aeff-3212-c777e4733217
Detects attackers attempting to disable Windows Defender using Powershell
Author: Christian Burkard (Nextron Systems)
· 2021-07-06 (modified 2023-08-17) · logsource: product=windows category=registry_set · a982fc9c-6333-4ffb-a51d-addb04e8b529
Detects the Setting of Windows Defender Exclusions
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-25 · logsource: product=windows category=registry_set · aa37cbb0-da36-42cb-a90f-fdf216fc7467
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value.
Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.
Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.
Author: Sittikorn S
· 2022-04-15 (modified 2025-10-25) · logsource: product=windows category=registry_delete · acd74772-5f88-45c7-956b-6a7b36c294d2
Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-05 · logsource: product=windows category=ps_script · ae2bdd58-0681-48ac-be7f-58ab4e593458
Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet
Author: Ján Trenčanský, frack113
· 2020-07-28 (modified 2023-11-22) · logsource: product=windows service=windefend · b28e58e4-2a72-4fae-bdee-0fbe904db642
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment
Author: Luc Génaux
· 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 (modified 2022-10-10) · logsource: product=windows category=process_creation · b7e2a8d4-74bb-4b78-adc9-3f92af2d4829
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Author: X__Junior (Nextron Systems)
· 2023-11-21 · logsource: product=windows category=registry_set · b888e3f2-224d-4435-b00b-9dd66e9ea1f1
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · b91e8d5e-0033-44fe-973f-b730316f23a1
Detects when a repository is exempted from secret scanning feature.
Author: Matt Anderson (Huntress)
· 2025-07-09 · logsource: product=windows category=process_creation · b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b
Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys.
This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives.
Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.
Author: @gott_cyber
· 2024-01-08 · logsource: product=windows service=security · bacf58c6-e199-4040-a94f-95dea0f1e45a
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Author: Ján Trenčanský, frack113
· 2020-07-28 (modified 2023-11-22) · logsource: product=windows service=windefend · bc275be9-0bec-4d77-8c8f-281a2df6710f
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-06 · logsource: product=windows service=windefend · bc92ca75-cd42-4d61-9a37-9d5aa259c88b
Detects the restoration of files from the defender quarantine
Author: kelnage
· 2023-09-07 (modified 2026-04-27) · logsource: product=okta service=okta · bde30855-5c53-4c18-ae90-1ff79ebc9578
Detects when an Okta user session starts where the user is behind an anonymising proxy service.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-06-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · bf4fc428-dcc3-4bbd-99fe-2422aeee2544
Potential adversaries stopping ETW providers recording loaded .NET assemblies.
Author: Austin Songer @austinsonger
· 2021-08-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · bf9e1387-b040-4393-9851-1598f8ecfae9
Detects disabling Windows Defender Exploit Guard Network Protection
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · c0514f28-fdae-42df-b886-06e2b2bc5b37
Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
Author: Tim Rauch, Elastic (idea)
· 2022-09-16 (modified 2022-11-26) · logsource: product=windows category=ps_script · c1344fa2-323b-4d2e-9176-84b4d4821c88
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-26 · logsource: product=windows category=process_creation · c17d47b7-dcd6-4109-87eb-d1817bd4cbc9
Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell.
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags.
Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.
Author: Janantha Marasinghe
· 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Author: yxinmiracle
· 2025-08-22 · logsource: product=windows category=process_creation · c443012c-7928-43bf-ac20-7eda5efe61ad
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 (modified 2025-11-27) · logsource: product=windows category=process_creation · c598cc0c-9e70-4852-b9eb-8921af79f598
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows.
EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process.
This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
Author: Florian Roth (Nextron Systems)
· 2022-03-04 (modified 2023-01-30) · logsource: product=windows category=process_creation · c6fb44c6-71f5-49e6-9462-1425d328aee3
Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV
Author: Mikhail Larin, oscd.community
· 2019-10-25 (modified 2021-11-27) · logsource: product=linux service=auditd · c830f15d-6f6e-430f-8074-6f73d6807841
Detect changes of syslog daemons configuration files
Author: Muhammad Faisal (@faisalusuf)
· 2024-03-07 · logsource: product=github service=audit · ccd55945-badd-4bae-936b-823a735d37dd
Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.
Author: Florian Roth (Nextron Systems)
· 2021-02-11 (modified 2023-02-21) · logsource: product=windows category=process_creation · cd1f961e-0b96-436b-b7c6-38da4583ec00
Detects the execution of "logman" utility in order to disable or delete Windows trace sessions
Author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)
· 2022-09-01 (modified 2025-08-27) · logsource: product=windows category=process_creation · ce72ef99-22f1-43d4-8695-419dcb5d9330
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts
Author: suktech24
· 2025-11-27 · logsource: product=aws service=cloudtrail · d2656e78-c069-4571-8220-9e0ab5913f19
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Author: Florian Roth (Nextron Systems), wagga
· 2018-03-20 (modified 2022-10-09) · logsource: product=windows service=security · d3abac66-f11c-4ed0-8acb-50cc29c97eed
Detects NetNTLM downgrade attack
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-01-26 · logsource: product=windows category=registry_set · d526c60a-e236-4011-b165-831ffa52ab70
Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the loading of known vulnerable drivers,
and its modification may indicate an attempt to bypass security controls. It is often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers,
particularly in scenarios involving Endpoint Detection and Response (EDR) bypass techniques.
This rule applies to systems that support the Vulnerable Driver Blocklist feature, including Windows 10 version 1903 and later, and Windows Server 2022 and later.
Note that this change will require a reboot to take effect, and this rule only detects the registry modification action.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-26 · logsource: product=windows category=registry_delete · d645ef86-2396-48a1-a2b6-b629ca3f57ff
Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
Author: Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)
· 2018-03-20 (modified 2024-12-03) · logsource: product=windows category=registry_event · d67572a0-e2ec-45d6-b8db-c100d14b8ef2
Detects NetNTLM downgrade attack
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-02 (modified 2024-03-19) · logsource: product=windows category=process_creation · d7662ff6-9e97-4596-a61d-9839e32dee8d
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not
Author: Chirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-01 · logsource: product=windows category=process_creation · da92713f-ca2d-4fab-8320-098013d3f43a
Detects the usage of SystemSettingsAdminFlows.exe to disable Windows Defender.
SystemSettingsAdminFlows.exe is a legitimate Windows component used for administrative configuration tasks.
However, attackers may abuse it to disable Windows Defender as part of their attack chain, especially in the context of ransomware or other malware campaigns.
Author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)
· 2023-03-28 (modified 2023-05-05) · logsource: product=windows service=windefend · dd80db93-6ec2-4f4c-a017-ad40da6ffe81
Detects issues with Windows Defender Real-Time Protection features
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-15 (modified 2025-03-18) · logsource: product=linux category=process_creation · de25eeb8-3655-4643-ac3a-b662d3f26b6b
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Author: Florian Roth (Nextron Systems)
· 2021-01-28 (modified 2023-12-15) · logsource: product=windows category=process_creation · dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a
Detects commands that temporarily turn off Volume Snapshots
Author: Florian Roth (Nextron Systems)
· 2022-11-09 · logsource: product=windows category=ps_script · e0d6c087-2d1c-47fd-8799-3904103c5a98
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
Detects Bitbucket global secret scanning rule deletion activity.
Author: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali
· 2022-08-01 (modified 2024-03-25) · logsource: product=windows category=registry_set · e1aa95de-610a-427d-b9e7-9b46cfafbe6a
Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry
Author: Milad Cheraghi
· 2025-05-26 (modified 2025-12-05) · logsource: product=linux service=auditd · e497a24e-9345-4a62-9803-b06d7d7cb132
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the `sysctl` command to set `kernel.randomize_va_space=0`
Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
Author: @BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-26 (modified 2023-11-11) · logsource: product=windows service=security · e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.
Author: @gott_cyber
· 2024-01-02 · logsource: product=windows category=process_creation · eb2d07d4-49cb-4523-801a-da002df36602
Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-06-07 (modified 2024-01-02) · logsource: product=windows category=ps_classic_provider_start · ec19ebab-72dc-40e1-9728-4c0b805d722c
Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.
Author: Luc Génaux
· 2026-04-28 · logsource: product=cisco service=aaa · ef0ff092-a24a-4fbc-beea-06c08d53e085
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Author: frack113
· 2021-07-12 (modified 2023-03-09) · logsource: product=windows category=process_creation · f0f7be61-9cf5-43be-9836-99d6ef448a18
Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
· 2019-04-08 (modified 2026-06-29) · logsource: product=windows category=registry_set · f2485272-a156-4773-82d7-1d178bc4905b
Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders.
Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-12-18 (modified 2023-02-14) · logsource: product=windows category=process_creation · f44800ac-38ec-471f-936e-3fa7d9c53100
Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
· 2019-04-08 (modified 2026-06-29) · logsource: product=windows service=security · f63508a0-c809-4435-b3be-ed819394d612
Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.
Author: @neu5ron
· 2017-07-30 (modified 2021-11-27) · logsource: product=windows service=security · f6de9536-0441-4b3f-a646-f4e00f300ffd
Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-04 (modified 2023-05-09) · logsource: product=windows category=ps_script · fa2559c8-1197-471d-9cdd-05a0273d4522
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
Author: Florian Roth (Nextron Systems)
· 2020-06-19 (modified 2021-11-27) · logsource: product=windows category=process_creation · fb50eb7a-5ab1-43ae-bcc9-091818cb8424
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
· 2022-08-08 (modified 2023-02-04) · logsource: product=windows category=process_creation · fc0e89b5-adb0-43c1-b749-c12a10ec37de
Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products
Author: Florian Roth (Nextron Systems)
· 2022-07-04 (modified 2023-08-17) · logsource: product=windows category=registry_set · fcddca7c-b9c0-4ddf-98da-e1e2d18b0157
Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections
Author: Austin Songer @austinsonger
· 2021-08-13 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · fe513c69-734c-4d4a-8548-ac5f609be82b
Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
Author: Daniil Yugoslavskiy, oscd.community
· 2020-10-19 (modified 2021-11-27) · logsource: product=macos category=process_creation · ff39f1a6-84ac-476f-a1af-37fcdf53d7c0
Detects disabling security tools
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · ff91e3f0-ad15-459f-9a85-1556390c138d
Detects when secret scanning rule is deleted for the project or repository.