| sigma |
Potential HackTool - Defendnot Security Center AV Registry Modification |
experimental |
2026-10-18 |
| sigma |
HackTool - Defendnot Installation via PowerShell One-Liner |
experimental |
2026-10-18 |
| sigma |
HackTool - Defendnot Default Scheduled Task Activity |
experimental |
2026-10-18 |
| sigma |
Suspicious Windows Service Tampering |
test |
2026-10-17 |
| sigma |
Disable of ETW Trace - Powershell |
test |
2026-10-12 |
| sigma |
ETW Trace Evasion Activity |
test |
2026-10-12 |
| splunk |
Windows DISM Remove Defender |
production |
2026-10-09 |
| splunk |
Windows DisableAntiSpyware Registry |
production |
2026-10-09 |
| splunk |
Disable Windows Behavior Monitoring |
production |
2026-10-02 |
| splunk |
Windows Registry Dotnet ETW Disabled Via ENV Variable |
production |
2026-10-02 |
| splunk |
Windows Impair Defenses Disable HVCI |
production |
2026-10-02 |
| splunk |
Disable ETW Through Registry |
production |
2026-10-02 |
| splunk |
Windows Impair Defenses Disable Auto Logger Session |
production |
2026-10-02 |
| splunk |
Disable Registry Tool |
production |
2026-10-02 |
| splunk |
Windows Attempt To Stop Security Service |
production |
2026-10-02 |
| splunk |
Unload Sysmon Filter Driver |
production |
2026-10-02 |
| splunk |
Powershell Disable Security Monitoring |
production |
2026-10-02 |
| splunk |
Disabling CMD Application |
production |
2026-10-02 |
| sigma |
HackTool - Defendnot Execution |
experimental |
2026-09-27 |
| splunk |
Windows AD Domain Controller Audit Policy Disabled |
production |
2026-09-22 |
| splunk |
Windows Important Audit Policy Disabled |
production |
2026-09-22 |
| splunk |
Windows Terminating Lsass Process |
production |
2026-09-08 |
| splunk |
Windows Filtering Platform Filter Added To Block EDR Process |
production |
2026-08-23 |
| splunk |
Windows EDRSilencer Custom Outbound Filter Added |
production |
2026-08-23 |
| splunk |
Windows Disable or Stop Browser Process |
production |
2026-08-14 |
| splunk |
ESXi Encryption Settings Modified |
production |
2026-08-12 |
| sigma |
Load Of RstrtMgr.DLL By An Uncommon Process |
test |
2026-07-28 |
| sigma |
AWS Bedrock Guardrail Updated |
experimental |
2026-07-10 |
| sigma |
AWS Bedrock Guardrail Deleted |
experimental |
2026-07-10 |
| sigma |
Windows Defender Disabled Via SystemSettingsAdminFlows.EXE |
experimental |
2026-07-01 |
| splunk |
Powershell Remove Windows Defender Directory |
production |
2026-06-29 |
| splunk |
Windows Powershell Import Applocker Policy |
production |
2026-06-29 |
| sigma |
Suspicious PROCEXP152.sys File Created In TMP |
test |
2026-06-29 |
| sigma |
Potential Privileged System Service Operation - SeLoadDriverPrivilege |
test |
2026-06-29 |
| splunk |
Powershell Windows Defender Exclusion Commands |
production |
2026-06-29 |
| sigma |
Suspicious Service Installed |
test |
2026-06-29 |
| sigma |
Uninstall Sysinternals Sysmon |
test |
2026-06-29 |
| sigma |
Sysmon Configuration Update |
test |
2026-06-29 |
| sigma |
Sysinternals PsSuspend Suspicious Execution |
test |
2026-06-29 |
| splunk |
Windows Disable or Modify Tools Via Taskkill |
production |
2026-06-25 |
| splunk |
Windows EDRSilencer Execution |
production |
2026-06-13 |
| splunk |
Windows Impair Defense Disable Web Evaluation |
production |
2026-06-08 |
| splunk |
Windows Defender Exclusion Registry Entry |
production |
2026-06-08 |
| splunk |
Disable Defender Submit Samples Consent Feature |
production |
2026-06-08 |
| splunk |
Add or Set Windows Defender Exclusion |
production |
2026-06-08 |
| splunk |
Disable Defender AntiVirus Registry |
production |
2026-06-08 |
| splunk |
Disable Windows SmartScreen Protection |
production |
2026-06-08 |
| splunk |
M365 Copilot Impersonation Jailbreak Attack |
production |
2026-06-04 |
| splunk |
Windows Increase in Group or Object Modification Activity |
production |
2026-05-13 |
| splunk |
Cisco ASA - Core Syslog Message Volume Drop |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Disabled via CLI |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Filters Configuration Tampering |
production |
2026-05-13 |
| splunk |
ESXi Download Errors |
production |
2026-05-13 |
| splunk |
ESXi Lockdown Mode Disabled |
production |
2026-05-13 |
| splunk |
ESXi Loghost Config Tampering |
production |
2026-05-13 |
| splunk |
ESXi VIB Acceptance Level Tampering |
production |
2026-05-13 |
| splunk |
M365 Copilot Non Compliant Devices Accessing M365 Copilot |
production |
2026-05-13 |
| splunk |
Azure AD Block User Consent For Risky Apps Disabled |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Delete Branch Ruleset |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable 2FA Requirement |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Classic Branch Protection Rule |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Dependabot |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable IP Allow List |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Register Self Hosted Runner |
production |
2026-05-13 |
| splunk |
GitHub Organizations Delete Branch Ruleset |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable 2FA Requirement |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable Classic Branch Protection Rule |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable Dependabot |
production |
2026-05-13 |
| splunk |
Microsoft Intune DeviceManagementConfigurationPolicies |
production |
2026-05-13 |
| splunk |
O365 Block User Consent For Risky Apps Disabled |
production |
2026-05-13 |
| splunk |
Disable AMSI Through Registry |
production |
2026-05-13 |
| splunk |
Disable Defender BlockAtFirstSeen Feature |
production |
2026-05-13 |
| splunk |
Disable Defender Enhanced Notification |
production |
2026-05-13 |
| splunk |
Disable Defender MpEngine Registry |
production |
2026-05-13 |
| splunk |
Disable Defender Spynet Reporting |
production |
2026-05-13 |
| splunk |
Disable Schedule Task |
production |
2026-05-13 |
| splunk |
Disable Show Hidden Files |
production |
2026-05-13 |
| splunk |
Disable Windows App Hotkeys |
production |
2026-05-13 |
| splunk |
Disabling ControlPanel |
production |
2026-05-13 |
| splunk |
Disabling Defender Services |
production |
2026-05-13 |
| splunk |
Disabling Firewall with Netsh |
production |
2026-05-13 |
| splunk |
Disabling FolderOptions Windows Feature |
production |
2026-05-13 |
| splunk |
Disabling NoRun Windows App |
production |
2026-05-13 |
| splunk |
Disabling Task Manager |
production |
2026-05-13 |
| splunk |
ETW Registry Disabled |
production |
2026-05-13 |
| splunk |
Excessive number of service control start as disabled |
production |
2026-05-13 |
| splunk |
Excessive Usage Of Taskkill |
production |
2026-05-13 |
| splunk |
Hide User Account From Sign-In Screen |
production |
2026-05-13 |
| splunk |
Linux Impair Defenses Process Kill |
production |
2026-05-13 |
| splunk |
Process Kill Base On File Path |
production |
2026-05-13 |
| splunk |
Unloading AMSI via Reflection |
production |
2026-05-13 |
| splunk |
Windows AD GPO Deleted |
production |
2026-05-13 |
| splunk |
Windows AD GPO Disabled |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Unblock File Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc |
production |
2026-05-13 |
| splunk |
Windows CrowdStrike Agent Registry Key Removal |
production |
2026-05-13 |
| splunk |
Windows Defender ASR or Threat Configuration Tamper |
production |
2026-05-13 |
| splunk |
Windows Event For Service Disabled |
production |
2026-05-13 |
| splunk |
Windows Excessive Disabled Services Event |
production |
2026-05-13 |
| splunk |
Windows Filtering Platform Policy Added to Block EDR Process |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Add Xml Applocker Rules |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Health Check Intervals |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Quick Scan Interval |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Throttle Rate |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Tracing Level |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Configure App Install Control |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Define Win Defender Threat Action |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Delete Win Defender Context Menu |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Delete Win Defender Profile Registry |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Deny Security Software With Applocker |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Controlled Folder Access |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Defender Firewall And Network |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Defender Protocol Recognition |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable PUA Protection |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Realtime Signature Delivery |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender App Guard |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender Compute File Hashes |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender Gen reports |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender Network Protection |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender Report Infection |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender Scan On Update |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Disable Win Defender Signature Retirement |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Overide Win Defender Phishing Filter |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Override SmartScreen Prompt |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Set Win Defender Smart Screen Level To Warn |
production |
2026-05-13 |
| splunk |
Windows Impair Defenses Disable Win Defender Auto Logging |
production |
2026-05-13 |
| splunk |
Windows Increase in User Modification Activity |
production |
2026-05-13 |
| splunk |
Windows MpCmdRun RemoveDefinitions Execution |
production |
2026-05-13 |
| splunk |
Windows Outlook Dialogs Disabled from Unusual Process |
production |
2026-05-13 |
| splunk |
Windows Raccine Scheduled Task Deletion |
production |
2026-05-13 |
| splunk |
Windows Registry Delete Task SD |
production |
2026-05-13 |
| splunk |
Wmic NonInteractive App Uninstallation |
production |
2026-05-13 |
| splunk |
Cisco Configuration Archive Logging Analysis |
production |
2026-05-13 |
| splunk |
Cisco SNMP Community String Configuration Changes |
production |
2026-05-13 |
| splunk |
M365 Copilot Agentic Jailbreak Attack |
production |
2026-05-13 |
| splunk |
M365 Copilot Information Extraction Jailbreak Attack |
production |
2026-05-13 |
| splunk |
M365 Copilot Jailbreak Attempts |
production |
2026-05-13 |
| sigma |
Cisco Dot1x Disabled |
experimental |
2026-04-28 |
| sigma |
Service Startup Type Change Via Wmic.EXE |
experimental |
2026-04-27 |
| sigma |
Okta User Session Start Via An Anonymising Proxy Service |
test |
2026-04-27 |
| sigma |
RedSun - TieringEngineService.exe Detected as EICAR Test File |
experimental |
2026-04-17 |
| sigma |
RedSun - Named Pipe Created |
experimental |
2026-04-17 |
| sigma |
Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine |
experimental |
2026-01-26 |
| sigma |
Vulnerable Driver Blocklist Registry Tampering Via CommandLine |
experimental |
2026-01-26 |
| sigma |
Windows Vulnerable Driver Blocklist Disabled |
experimental |
2026-01-26 |
| sigma |
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location |
experimental |
2026-01-09 |
| sigma |
WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze |
experimental |
2026-01-09 |
| sigma |
Devcon Execution Disabling VMware VMCI Device |
experimental |
2026-01-02 |
| sigma |
Windows Credential Guard Disabled - Registry |
experimental |
2025-12-26 |
| sigma |
Windows Credential Guard Related Registry Value Deleted - Registry |
experimental |
2025-12-26 |
| sigma |
Windows Credential Guard Registry Tampering Via CommandLine |
experimental |
2025-12-26 |
| sigma |
AMSI Disabled via Registry Modification |
experimental |
2025-12-25 |
| sigma |
Windows AMSI Related Registry Tampering Via CommandLine |
experimental |
2025-12-25 |
| sigma |
Potential Tampering With Security Products Via WMIC |
test |
2025-12-15 |
| sigma |
ASLR Disabled Via Sysctl or Direct Syscall - Linux |
experimental |
2025-12-05 |
| sigma |
AWS GuardDuty Detector Deleted Or Updated |
experimental |
2025-11-27 |
| sigma |
Hacktool - EDR-Freeze Execution |
experimental |
2025-11-27 |
| sigma |
Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze |
experimental |
2025-11-27 |
| sigma |
Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs |
experimental |
2025-11-27 |
| sigma |
PPL Tampering Via WerFaultSecure |
experimental |
2025-11-23 |
| sigma |
Removal Of SD Value to Hide Schedule Task - Registry |
test |
2025-10-25 |
| sigma |
Removal Of Index Value to Hide Schedule Task - Registry |
test |
2025-10-25 |
| sigma |
WFP Filter Added via Registry |
experimental |
2025-10-23 |
| sigma |
Kaspersky Endpoint Security Stopped Via CommandLine - Linux |
experimental |
2025-10-18 |
| sigma |
Filter Driver Unloaded Via Fltmc.EXE |
test |
2025-10-07 |
| sigma |
Removal Of AMSI Provider Registry Keys |
test |
2025-10-07 |
| sigma |
Suspicious Uninstall of Windows Defender Feature via PowerShell |
experimental |
2025-08-22 |
| sigma |
Windows Defender Threat Severity Default Action Modified |
experimental |
2025-07-11 |
| sigma |
PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction' |
experimental |
2025-07-11 |
| sigma |
Disabling Windows Defender WMI Autologger Session via Reg.exe |
experimental |
2025-07-09 |
| sigma |
Windows Defender Context Menu Removed |
experimental |
2025-07-09 |
| sigma |
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE |
test |
2025-06-04 |
| sigma |
Obfuscated PowerShell OneLiner Execution |
test |
2025-04-16 |
| sigma |
Disable Or Stop Services |
test |
2025-03-18 |
| sigma |
WDAC Policy File Creation In CodeIntegrity Folder |
experimental |
2025-01-30 |
| sigma |
Terminate Linux Process Via Kill |
test |
2024-12-12 |
| sigma |
NetNTLM Downgrade Attack - Registry |
test |
2024-12-03 |
| sigma |
HackTool - Stracciatella Execution |
test |
2024-11-23 |
| sigma |
Disable Windows Defender Functionalities Via Registry Keys |
test |
2024-10-07 |
| sigma |
Python Function Execution Security Warning Disabled In Excel - Registry |
test |
2024-08-23 |
| sigma |
Antivirus Filter Driver Disallowed On Dev Drive - Registry |
test |
2024-08-16 |
| sigma |
Github Secret Scanning Feature Disabled |
test |
2024-07-19 |
| sigma |
Hypervisor Enforced Paging Translation Disabled |
test |
2024-07-05 |
| sigma |
Windows Hypervisor Enforced Code Integrity Disabled |
test |
2024-07-05 |
| sigma |
Windows Defender Threat Detection Service Disabled |
stable |
2024-07-02 |
| sigma |
Windows Defender Service Disabled - Registry |
test |
2024-03-25 |
| sigma |
Sysmon Driver Altitude Change |
test |
2024-03-25 |
| sigma |
Add SafeBoot Keys Via Reg Utility |
test |
2024-03-19 |
| sigma |
Github Push Protection Disabled |
test |
2024-03-07 |
| sigma |
Github Push Protection Bypass Detected |
test |
2024-03-07 |
| sigma |
Bitbucket Secret Scanning Rule Deleted |
test |
2024-02-25 |
| sigma |
Bitbucket Secret Scanning Exempt Repository Added |
test |
2024-02-25 |
| sigma |
Bitbucket Project Secret Scanning Allowlist Added |
test |
2024-02-25 |
| sigma |
Bitbucket Audit Log Configuration Updated |
test |
2024-02-25 |
| sigma |
Bitbucket Global SSH Settings Changed |
test |
2024-02-25 |
| sigma |
Bitbucket Global Secret Scanning Rule Deleted |
test |
2024-02-25 |
| sigma |
HackTool - EDRSilencer Execution - Filter Added |
test |
2024-01-30 |
| sigma |
Write Protect For Storage Disabled |
test |
2024-01-18 |
| sigma |
Sysmon Application Crashed |
test |
2024-01-17 |
| sigma |
Windows Filtering Platform Blocked Connection From EDR Agent Binary |
test |
2024-01-08 |
| sigma |
Powershell Defender Disable Scan Feature |
test |
2024-01-02 |
| sigma |
Tamper Windows Defender - PSClassic |
test |
2024-01-02 |
| sigma |
Tamper Windows Defender - ScriptBlockLogging |
test |
2024-01-02 |
| sigma |
HackTool - EDRSilencer Execution |
test |
2024-01-02 |
| sigma |
Disabled Volume Snapshots |
test |
2023-12-15 |
| sigma |
Load Of RstrtMgr.DLL By A Suspicious Process |
test |
2023-11-28 |
| sigma |
HackTool - CobaltStrike BOF Injection Pattern |
test |
2023-11-28 |
| sigma |
Windows Defender Configuration Changes |
stable |
2023-11-24 |
| sigma |
Windows Defender Malware And PUA Scanning Disabled |
stable |
2023-11-22 |
| sigma |
Windows Defender Grace Period Expired |
stable |
2023-11-22 |
| sigma |
Windows Defender Real-time Protection Disabled |
stable |
2023-11-22 |
| sigma |
Windows Defender Virus Scanning Feature Disabled |
stable |
2023-11-22 |
| sigma |
Uncommon Extension In Keyboard Layout IME File Registry Value |
test |
2023-11-21 |
| sigma |
Suspicious Path In Keyboard Layout IME File Registry Value |
test |
2023-11-21 |
| sigma |
Windows Defender Exclusion List Modified |
test |
2023-11-11 |
| sigma |
Windows Defender Exclusion Registry Key - Write Access Requested |
test |
2023-11-11 |
| sigma |
Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback |
test |
2023-11-03 |
| sigma |
Diamond Sleet APT Scheduled Task Creation - Registry |
test |
2023-10-24 |
| sigma |
ESXi Syslog Configuration Change Via ESXCLI |
test |
2023-09-04 |
| sigma |
Python Function Execution Security Warning Disabled In Excel |
test |
2023-08-22 |
| sigma |
Hide Schedule Task Via Index Value Tamper |
test |
2023-08-17 |
| sigma |
Disable PUA Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Disabled Windows Defender Eventlog |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For SCM |
test |
2023-08-17 |
| sigma |
Disable Exploit Guard Network Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled In .NET Processes - Sysmon Registry |
test |
2023-08-17 |
| sigma |
Disable Tamper Protection on Windows Defender |
test |
2023-08-17 |
| sigma |
Windows Defender Exclusions Added - Registry |
test |
2023-08-17 |
| sigma |
Potential AMSI COM Server Hijacking |
test |
2023-08-17 |
| sigma |
ETW Logging Disabled For rpcrt4.dll |
test |
2023-08-17 |
| sigma |
Disable Privacy Settings Experience in Registry |
test |
2023-08-17 |
| sigma |
Tamper With Sophos AV Registry Keys |
test |
2023-08-17 |
| sigma |
Scripted Diagnostics Turn Off Check Enabled - Registry |
test |
2023-08-17 |
| sigma |
Suspicious Application Allowed Through Exploit Guard |
test |
2023-08-17 |
| sigma |
Microsoft Office Protected View Disabled |
test |
2023-08-17 |
| sigma |
Windows Defender Definition Files Removed |
test |
2023-07-18 |
| sigma |
Security Service Disabled Via Reg.EXE |
test |
2023-06-05 |
| sigma |
Potential AMSI Bypass Script Using NULL Bits |
test |
2023-05-09 |
| sigma |
Potential AMSI Bypass Using NULL Bits |
test |
2023-05-09 |
| sigma |
Windows Defender Real-Time Protection Failure/Restart |
stable |
2023-05-05 |
| sigma |
Microsoft Malware Protection Engine Crash |
test |
2023-04-14 |
| sigma |
Microsoft Malware Protection Engine Crash - WER |
test |
2023-04-14 |
| sigma |
Potential Ke3chang/TidePool Malware Activity |
test |
2023-03-10 |
| sigma |
Uninstall Crowdstrike Falcon Sensor |
test |
2023-03-09 |
| sigma |
Service StartupType Change Via Sc.EXE |
test |
2023-03-04 |
| sigma |
Service StartupType Change Via PowerShell Set-Service |
test |
2023-03-04 |
| sigma |
Suspicious Windows Trace ETW Session Tamper Via Logman.EXE |
test |
2023-02-21 |
| sigma |
Potential Windows Defender Tampering Via Wmic.EXE |
test |
2023-02-14 |
| sigma |
PUA - CleanWipe Execution |
test |
2023-02-14 |
| sigma |
Windows Firewall Disabled via PowerShell |
test |
2023-02-13 |
| sigma |
Sysmon Driver Unloaded Via Fltmc.EXE |
test |
2023-02-13 |
| sigma |
Folder Removed From Exploit Guard ProtectedFolders List - Registry |
test |
2023-02-08 |
| sigma |
HackTool - PowerTool Execution |
test |
2023-02-04 |
| sigma |
SafeBoot Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Service Registry Key Deleted Via Reg.EXE |
test |
2023-02-04 |
| sigma |
Potential AMSI Bypass Via .NET Reflection |
test |
2023-02-03 |
| sigma |
Powershell Base64 Encoded MpPreference Cmdlet |
test |
2023-01-30 |
| sigma |
Cisco Disabling Logging |
test |
2023-01-04 |
| sigma |
Potential Suspicious Activity Using SeCEdit |
test |
2022-12-30 |
| sigma |
ETW Logging Disabled In .NET Processes - Registry |
test |
2022-12-20 |
| sigma |
ETW Logging Tamper In .NET Processes Via CommandLine |
test |
2022-12-09 |
| sigma |
Win Defender Restored Quarantine File |
test |
2022-12-06 |
| sigma |
Windows Defender Exclusions Added |
stable |
2022-12-06 |
| sigma |
Windows Defender Exploit Guard Tamper |
test |
2022-12-06 |
| sigma |
Windows Defender Submit Sample Feature Disabled |
stable |
2022-12-06 |
| sigma |
Microsoft Defender Tamper Protection Trigger |
stable |
2022-12-06 |
| sigma |
Windows Defender Exclusions Added - PowerShell |
test |
2022-11-26 |
| sigma |
Disable Windows Defender AV Security Monitoring |
test |
2022-11-18 |
| sigma |
AMSI Bypass Pattern Assembly GetType |
test |
2022-11-09 |
| sigma |
Reg Add Suspicious Paths |
test |
2022-10-10 |
| sigma |
AWS GuardDuty Important Change |
test |
2022-10-09 |
| sigma |
Raccine Uninstall |
test |
2022-10-09 |
| sigma |
Google Cloud Firewall Modified or Deleted |
test |
2022-10-09 |
| sigma |
NetNTLM Downgrade Attack |
test |
2022-10-09 |
| sigma |
Taskkill Symantec Endpoint Protection |
test |
2022-09-13 |
| sigma |
Disable-WindowsOptionalFeature Command PowerShell |
test |
2022-09-10 |
| sigma |
Dism Remove Online Package |
test |
2022-08-26 |
| sigma |
Azure Kubernetes Events Deleted |
test |
2022-08-23 |
| sigma |
Tamper Windows Defender Remove-MpPreference |
test |
2022-08-05 |
| sigma |
Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging |
test |
2022-08-05 |
| sigma |
Powershell Defender Exclusion |
test |
2022-05-12 |
| sigma |
Logging Configuration Changes on Linux Host |
test |
2021-11-27 |
| sigma |
Auditing Configuration Changes on Linux Host |
test |
2021-11-27 |
| sigma |
Disabled IE Security Features |
test |
2021-11-27 |
| sigma |
Weak Encryption Enabled and Kerberoast |
test |
2021-11-27 |
| sigma |
Disable Security Tools |
test |
2021-11-27 |
| sigma |
AWS SecurityHub Findings Evasion |
stable |
2021-06-28 |