Detection test

github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md

https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md

Published on: github.com

ATT&CK techniques those detections carry

T1685Disable or Modify Tools
T1564Hide Artifacts
T1112Modify Registry
T1489Service Stop

Open the original

21 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Microsoft Office Protected View Disabled	High	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Service Binary in Suspicious Folder	High	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Tamper Windows Defender - ScriptBlockLogging	High	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Windows Defender Virus Scanning Feature Disabled	High	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Windows Defender Real-time Protection Disabled	High	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Sysmon Configuration Modification	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Sysmon Configuration Error	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Removal Of AMSI Provider Registry Keys	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Uninstall Crowdstrike Falcon Sensor	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Uninstall Sysinternals Sysmon	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Suspicious Windows Service Tampering	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Disable Windows Defender AV Security Monitoring	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Powershell Defender Exclusion	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Powershell Base64 Encoded MpPreference Cmdlet	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Defender Definition Files Removed	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Dism Remove Online Package	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Tamper Windows Defender - PSClassic	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Defender Malware And PUA Scanning Disabled	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Defender Grace Period Expired	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Defender Threat Detection Service Disabled	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Disable Security Tools	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 21 of 21

Filter in the catalogue