Vendor
Potential Evasion via Windows Filtering Platform Blocking Security Software
2 rules 2 TTPsAdversaries may add malicious Windows Filtering Platform (WFP) rules to prevent endpoint security solutions from sending telemetry data, impairing defenses, which this rule detects by identifying multiple WFP block events where the process name is associated with endpoint security software.
Suspicious Registry Hive Access via RegBack
2 rules 1 TTPThis rule detects attempts to access registry backup hives (SAM, SECURITY, SYSTEM) via RegBack on Windows systems, which can contain or enable access to credential material.
Windows Defender Disabled via Registry Modification
2 rules 3 TTPsAttackers modify the Windows Defender registry settings to disable the service or set the service to be started manually, evading defenses.
PowerShell Script Block Logging Disabled via Registry Modification
2 rules 2 TTPsAttackers may disable PowerShell Script Block Logging by modifying the registry to conceal their activities on the host and evade detection by setting the `EnableScriptBlockLogging` registry value to 0, impacting security monitoring and incident response capabilities.
Third-party Backup Files Deleted via Unexpected Process
2 rules 2 TTPsThis detection identifies the deletion of backup files by processes outside of the backup suite, specifically targeting Veritas and Veeam backups, which may indicate an attempt to prevent recovery from ransomware.
Microsoft Defender Tampering via Registry Modification
2 rules 2 TTPsAdversaries may disable or tamper with Microsoft Defender features via registry modifications to evade detection and conceal malicious behavior on Windows systems.
LSASS Loading Suspicious DLL
2 rules 2 TTPs 9 IOCsDetection of LSASS loading an unsigned or untrusted DLL, which can indicate credential access attempts by malicious actors targeting sensitive information stored in the LSASS process.