Search and filter across all detection sources
876 rules
[CROWDSTRIKE] Defense Evasion Tactic Catchall
AWS DNS Logs Deleted
Detects when logs for a DNS Resolver have been removed.
AWS VPC Flow Logs Removed
Detects when logs for a VPC have been removed.
Defense Evasion Alerts Generated by Defender For Endpoint
This query lists the Defense Evasion Alerts Generated by Defender For Endpoint.
[CROWDSTRIKE] Possible Defense Evasion Blocked - Msiexec Launched With Unusual Arguments
[CROWDSTRIKE] Possible Defense Evasion Detected - Msiexec Launched With Unusual Arguments
[CROWDSTRIKE] Possible Defense Evasion Killed - Msiexec Launched With Unusual Arguments
Azure Alert Rules Deleted
Detects when Azure alert rules are deleted. Deleting alert rules disables security notifications and is a common defense evasion technique.
CloudTrail Stopped
A CloudTrail Trail was modified.
EC2 VPC Modified
An EC2 VPC was modified.
[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Remove CsDeviceControl From Registry
[CROWDSTRIKE] Possible Defense Evasion Detected - Process Attempted To Remove CsDeviceControl From Registry
[CROWDSTRIKE] Possible Defense Evasion Killed - Process Attempted To Remove CsDeviceControl From Registry
Account Security Configuration Changed
An account wide security configuration was changed.
AWS CloudTrail Retention Lifecycle Too Short
Detects when an S3 bucket containing CloudTrail logs has been modified to delete data after a short period of time.
[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Executable Written In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Network Access In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Quarantined Files In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Executable Written In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Network Access In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Quarantined Files In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Killed - Executable Written In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Killed - Network Access In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Killed - Quarantined Files In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Modify System AMSI Provider Configuration