Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,504
detections

Search detections

Filters

Showing 30 of 11,504

Entra ID Privileged Role Assigned to Another Account

Identifies when a privileged Microsoft Entra ID directory role is assigned from one account to a different account. The actor can be a user or an application (service principal), and the member can be a user or a service principal. Privileged roles can be used to take over the tenant, reset credentials, add credentials to applications, or control mail and collaboration services, so an unexpected assignment is a strong persistence and privilege escalation signal.

T1078T1078.004T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

HighElastic detection rules

Entra ID Application Self-Assigned to Privileged Role

Identifies an Entra ID application (service principal) assigning itself to a privileged directory role. An application typically does not promote itself, and a multi-tenant vendor application is even more uncommon. Any service principal self-assigning a privileged role should be investigated. Adversaries may compromise vendor application credentials and then escalate privileges to Exchange Administrator or Global Administrator, or subsequently add client secrets to other applications.

T1078T1078.004T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

MediumElastic detection rules

Entra ID Service Principal Credentials Created by Unusual User

Identifies when new Service Principal credentials have been added in Microsoft Entra ID. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements.

T1098T1098.001

Written by: ElasticAttributed by Elastic detection rulesand 1 more author
Licence: Elastic License 2.0
Published: Oct 20, 2026

HighElastic detection rules

Entra ID Register Device with Phishing Kit or ROADtools User Agent

Detects a successful Microsoft Entra ID Register device audit event for an Azure AD join or Azure AD register whose user agent is a Dsreg client string hardcoded by device-registration tooling. "Dsreg/10.0 (Windows 10.0.19045.2006)" is the frozen user agent used by device code and adversary-in-the-middle (AiTM) phishing-as-a-service kits such as Tycoon2FA and Kali365 when they register a device after capturing a victim session. "Dsreg/10.0 (Windows 10.0.19041.

T1098T1098.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

HighElastic detection rules

Entra ID Device Registration with Phishing Kit Default OS Build

Identifies a Microsoft Entra ID device registration where the recorded cloud device operating system build is "10.0.19045.2006" and the device display name follows the default "DESKTOP-" pattern. This is the frozen default device profile observed when adversary-in-the-middle (AiTM) phishing kits such as Tycoon2FA and Kali365 register Azure AD-joined devices after capturing a victim session, in order to acquire a Primary Refresh Token (PRT) and establish persistence.

T1098T1098.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

HighElastic detection rules

Entra ID Global Administrator Role Assigned

In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Microsoft Entra ID and services that use Microsoft Entra ID identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online.

T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

MediumElastic detection rules

Entra ID Application Credential Modified

Identifies when a new credential is added to an application in Azure. An application may use a certificate or secret string to prove its identity when requesting a token. Multiple certificates and secrets can be added for an application and an adversary may abuse this by creating an additional authentication method to evade defenses or persist in an environment.

T1098T1098.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

MediumElastic detection rules

Entra ID Service Principal with Unusual Source ASN

Identifies Entra ID service principal sign-ins where the workload identity and source autonomous system number (ASN) together have not appeared in recent history. Attackers who obtain application secrets or tokens often authenticate from unfamiliar hosting providers, residential or VPN egress, or networks outside normal automation footprints, which can precede data access, lateral movement, or ransomware activity in the tenant.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 20, 2026

MediumSigmaHQ

Potential HackTool - Defendnot Security Center AV Registry Modification

Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe. These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software. But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.

T1685

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

HighSigmaHQ

HackTool - Defendnot Execution

Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.

T1685

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

HighSigmaHQ

HackTool - Defendnot Installation via PowerShell One-Liner

Detects execution of Defendnot installation via PowerShell one-liner that downloads and executes the Defendnot script from a remote URL. Defendnot is a hacktool that abuses Microsoft's undocumented WSC API to disable Windows Defender by registering itself as a fake antivirus product.

T1685

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

MediumSigmaHQ

Potential Antivirus Software DLL Sideloading

Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec...etc

T1574.001

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

HighSigmaHQ

Legitimate Application Writing Files In Uncommon Location

Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.

T1105T1218

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

HighSigmaHQ

HackTool - Defendnot Default Scheduled Task Activity

Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security. It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender. During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.

T1053.005T1685

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

LowSigmaHQ

MacOS Network Service Scanning

Detects enumeration of local or remote network services.

T1046

Written by: Alejandro OrtunoAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

HighSigmaHQ

Sign-in Failure Due to Conditional Access Requirements Not Met

Define a baseline threshold for failed sign-ins due to Conditional Access failures

T1078.004T1110

Written by: Yochana HendersonAttributed by SigmaHQand 1 more author
Licence: Detection Rule License 1.1
Published: Oct 20, 2026

InformationalSplunk security content

Windows DNS Query Request by Telegram Bot API

The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors.

T1071.004T1102.002

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows Process Outbound Connection To Social Media Domain

This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains. It leverages Sysmon Event ID 3 to surface this anomalous behavior. Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.

T1586.001

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows Password Managers Discovery

The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation.

T1555.005

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows DNS Query Request To TinyUrl

The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl. URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints. While tinyurl.

T1105

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Windows Boot or Logon Autostart Execution In Startup Folder

The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon.

T1547.001

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

PowerShell Download from Code Hosting Service

This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg. These code hosting services can be abused to stage payloads, but administrators and developers also download files from them. A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed.

T1059.001T1105

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Non Firefox Process Access Firefox Profile Dir

The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. It leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant because it may indicate attempts by malware, such as RATs or trojans, to harvest user information.

T1555.003

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Executables Or Script Creation In Temp Path

The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.

T1036

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

InformationalSplunk security content

Executables Or Script Creation In Suspicious Path

The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.

T1036

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

Download Files Using Telegram

The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation.

T1105

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS Repeated CloudWatch Logs Read Operations

The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a five-minute period. It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.

T1530

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS IAM Role Created with External Trust

Detects a successful AWS IAM CreateRole event whose trust policy allows sts:AssumeRole by a principal in another AWS account or by a wildcard principal. This configuration may provide persistent access if the principal can assume the role. The event alone does not establish that the role was assumed or that its creation was unauthorized.

T1098.003

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS EC2 Startup Script Modified on Stopped Instance

A successful EC2 StopInstances request was followed within one hour by a successful ModifyInstanceAttribute request targeting userData on the same instance, by the same IAM principal. This may indicate an attempt to change instance startup behavior or establish persistence. These CloudTrail events do not confirm that the modified user-data script executed.

T1578.005

Written by: Maria Jose ErquiagaAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 19, 2026

MediumSplunk security content

AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity

Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.

T1021.004T1021.008

Written by: Maria Jose ErquiagaAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 19, 2026

Load more detections

Loading detection rules

Back to results

HighSigmaHQ Swachchhanda Shrawan Poudel (Nextron Systems)

HackTool - Defendnot Installation via PowerShell One-Liner

Description

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Network Devices Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: windows
Log source category: ps_script

Known benign triggers

Unlikely

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Defense Impairment

T1685Disable or Modify Tools 282 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
github.com/es3n1n/defendnot/blob/525176a37721ead27d3f9f77f59b58abfc305988/README.md#one-liner	Tool	3

From the source

At source: Open at source
Upstream identifier: 50b159ba-a147-40f7-9d11-561e724b8a2e
Tagged by the source as: attack.defense-impairment

Licence

Published under: Detection Rule License 1.1Read the licence
Attribution: Required

Authorship

Written by: Swachchhanda Shrawan Poudel (Nextron Systems)
Published: Oct 20, 2026
Version: 1