Search and filter across all detection sources
1,534 rules
[ZSCALER-ZIA] Unscannable content transferred (possible AV/sandbox evasion)
Methodology_Suspicious_Shortcut_Evasion [yara]
Non-standard .URLs and evasion
[CROWDSTRIKE] Defense Evasion Tactic Catchall
apt_evasive_panda_rphost_dll [yara_rules]
Detects DLL used by Evasive Panda
apt_evasive_panda_downloader_certificate_exe [yara_rules]
Detects downloader used by Evasive Panda (certificate.exe)
Defense Evasion Alerts Generated by Defender For Endpoint
This query lists the Defense Evasion Alerts Generated by Defender For Endpoint.
Potential Command Line Path Traversal Evasion Attempt
Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline
[CROWDSTRIKE] Possible Defense Evasion Blocked - Msiexec Launched With Unusual Arguments
[CROWDSTRIKE] Possible Defense Evasion Detected - Msiexec Launched With Unusual Arguments
[CROWDSTRIKE] Possible Defense Evasion Killed - Msiexec Launched With Unusual Arguments
Link: Spam website with evasion indicators
Detects messages containing links to spam websites that show signs of evasion techniques, including blocklisted IP provider messages or rate limiting responses when analyzed.
[APACHE] CVE-2014-6271 Attempt In HTTP Headers Line Continuation Evasion CRLF
[APACHE] CVE-2014-6271 Attempt In HTTP Headers Line Continuation Evasion LF
[CROWDSTRIKE] Possible Defense Evasion Blocked - Process Attempted To Remove CsDeviceControl From Registry
[CROWDSTRIKE] Possible Defense Evasion Detected - Process Attempted To Remove CsDeviceControl From Registry
[CROWDSTRIKE] Possible Defense Evasion Killed - Process Attempted To Remove CsDeviceControl From Registry
[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Executable Written In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Network Access In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Quarantined Files In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Executable Written In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Network Access In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Quarantined Files In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Killed - Executable Written In A Detection Summary Event