Search and filter across all detection sources
150 rules
PUA - AdvancedRun Execution
Detects the execution of AdvancedRun utility
tool_advancedrun_strings [yara_rules]
Detects AdvancedRun strings
PUA - Advanced Port Scanner Execution
Detects the use of Advanced Port Scanner.
Google Workspace Advanced Protection Program
Your organization's Google Workspace Advanced Protection Program settings were modified.
[BitdefenderGZ] Advanced Threat Control AVC Blocked APP
[BitdefenderGZ] Advanced Threat Control AVC Blocked Exploit
[BitdefenderGZ] Advanced Threat Control IDS Blocked APP
GSuite User Advanced Protection Change
A user disabled advanced protection for themselves.
[Barracuda] Email Gateway Advanced_Threat_Protection Event Detected
PUA - Advanced IP/Port Scanner Update Check
Detect the update check performed by Advanced IP/Port Scanner utilities.
Group of Microsoft Windows Firewall With Advanced Security rules
[ZSCALER-ZIA] Malware download blocked by Advanced Threat Protection
PUA - Advanced IP Scanner Execution
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Advanced IP Scanner - File Event
PUA - AdvancedRun Suspicious Execution
Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts
[MSEXCHANGE-MANAGEMENT] defender-for-office-365 Cmdlet Get-AdvancedThreatProtectionDocumentDetail Successfully Executed
[MSEXCHANGE-MANAGEMENT] defender-for-office-365 Cmdlet Get-AdvancedThreatProtectionDocumentReport Successfully Executed