Browse Rules

[CROWDSTRIKE] Possible Defense Evasion Blocked - A Suspicious Process Is Attempting To Disable Or Modify Security Tools

[CROWDSTRIKE] Possible Defense Evasion Blocked - A Suspicious Process Is Attempting To Disable Or Modify Security Tools

[CROWDSTRIKE] Possible Defense Evasion Detected - A Suspicious Process Is Attempting To Disable Or Modify Security Tools

[CROWDSTRIKE] Possible Defense Evasion Detected - A Suspicious Process Is Attempting To Disable Or Modify Security Tools

[CROWDSTRIKE] Possible Defense Evasion Killed - A Suspicious Process Is Attempting To Disable Or Modify Security Tools

[CROWDSTRIKE] Possible Defense Evasion Killed - A Suspicious Process Is Attempting To Disable Or Modify Security Tools

Slack Legal Hold Policy Modified

Detects changes to configured legal hold policies

Slack Information Barrier Modified

Detects when a Slack information barrier is deleted/updated

GitHub Repository Ruleset Modified

Disabling repository ruleset controls could indicate malicious use of admin credentials in an attempt to hide activity.

SELinux Disabled - *nix [splunk-edr]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.

Slack DLP Modified

Detects when a Data Loss Prevention (DLP) rule has been deactivated or a violation has been deleted

SELinux Disabled - *nix [splunk-unix]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.

Syslog Forwarding Tampering via iptables_ufw - *nix [splunk-edr]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.

Syslog Forwarding Tampering via iptables_ufw - *nix [splunk-unix]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.

Slack Microsoft Intune Mobile Device Management Disabled

Detects when Microsoft Intune MDM integration is disabled for Slack, removing mobile security controls and enabling data exfiltration via unmanaged devices. Intune enforces policies preventing copy/paste to unmanaged apps, requires device encryption, blocks jailbroken devices, and enables remote wipe. Disabling these controls allows unrestricted Slack access from personal or compromised devices without security restrictions.

Windows Disable or Modify Tools Via Taskkill

The following analytic identifies the use of taskkill.exe to forcibly terminate processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific taskkill parameters. This activity is significant because it can indicate attempts to disable security tools or disrupt legitimate applications, a common tactic in malware operations. If confirmed malicious, this behavior could allow attackers to evade detection, disrupt system sta

AWS Bedrock Guardrail Updated or Deleted

An Amazon Bedrock Guardrail was updated or deleted. Amazon Bedrock Guardrails are used to implement application-specific safeguards based on your use cases and responsible AI policies. Updating or deleting a guardrail can have security implications to your AI workloads.

Azure Network Watcher Deleted

Detects when an Azure Network Watcher is deleted. Network Watcher is a regional service that enables monitoring and diagnostics for network resources in Azure, including packet capture, connection monitoring, flow logging, and network performance diagnostics. Adversaries may delete Network Watchers to disable network visibility and evade detection during lateral movement, data exfiltration, or other network-based attacks.

Defender Registry Values Modified [splunk-edr]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

Defender Registry Values Modified [splunk-powershell]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

SELinux Configuration Creation or Renaming

This rule detects the creation or renaming of the SELinux configuration file. SELinux is a security module that provides access control security policies. Modifications to the SELinux configuration file may indicate an attempt to impair defenses by disabling or modifying security tools.

Defender Registry Values Modified [snowflake-crowdstrikefdr_process]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

Defender Registry Values Modified [splunk-sysmon]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

Disable UAC

Threat actors often, after compromising a machine, try to disable User Access Control (UAC) to escalate privileges. This is often done by changing the registry key for system policies using “reg.exe”, a legitimate tool provided by Microsoft for modifying the registry via command prompt or scripts. This action interferes with UAC and may enable a threat actor to escalate privileges on the compromised system, thereby allowing further exploitation of the system.

Defender Registry Values Modified [splunk-winevent]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

Windows Credential Guard Registry Tampering Via CommandLine

Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule

Windows Credential Guard Registry Tampering Via CommandLine

Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule

Windows Credential Guard Registry Tampering Via CommandLine

Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule