Browse Rules

Impacket Wmiexec Module

Detection of impacket's wmiexec example, used by attackers to execute commands remotely.

Microsoft Defender Antivirus Disabled Base64 Encoded

Detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through base64 encoded PowerShell command line.

AWS CloudTrail Route 53 Domain Transfer Lock Disabled

Detects when the transfer lock feature is disabled on a domain name handled by AWS Route 53 service.

Microsoft Defender Antivirus Signatures Removed With MpCmdRun

Detects attempts to remove Microsoft Defender Antivirus (MDAV) Signatures using MpCmdRun legitimate MDAV executable. No signatures mean MDAV will be less effective (or completely useless depending on the option used).

PowerShell AMSI Deactivation Bypass Using .NET Reflection

Detects Request to amsiInitFailed that can be used to disable AMSI (Antimalware Scan Interface) Scanning. More information about Antimalware Scan Interface https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal.