Query: write Sigma for Detects actions taken by Windows Defender malware detection engines
Matching passage: Sigma rule: Detects actions taken by Windows Defender malware detection engines. Logsource: windows / windefend. Rule: title: Windows Defender Threat Detected id: 57b649ef-ff42-4fb0-8bf6-62da243a1708 status: stable description: Detects actions taken by Windows Defender malware detection engines references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus author: Ján Trenčanský date: 2020-07-28 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: - 1006 - 1015 - 1116 - 1117 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc. Logsource: windows / image_load. Rule: title: Potential Antivirus Software DLL Sideloading id: 552b6b65-df37-4d3e-a258-f2fc4771ae54 status: test description: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_bitdefender: ImageLoaded|endswith: \log.dll filter_log_dll_bitdefender: ImageLoaded|startswith: - C:\Program Files\Bitdefender Antivirus Free\ - C:\Program Files (x86)\Bitdefender Antivirus Free\ filter_log_dll_dell_sar: Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe ImageLoaded: - C:\Program Files\Dell\SARemediation\plugin\log.dll - C:\Program Files\Dell\SARemediation\audit\log.dll filter_log_dll_canon: ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\ filter_log_dll_avast: ImageLoaded: - C:\Program Files\AVAST Software\Avast\log.dll - C:\Program Files (x86)\AVAST Software\Avast\log.dll filter_log_dll_avg: ImageLoaded: - C:\Program Files\AVG\Antivirus\log.dll - C:\Program Files (x86)\AVG\Antivirus\log.dll selection_fsecure: ImageLoaded|endswith: \qrt.dll filter_fsecure: ImageLoaded|startswith: - C:\Program Files\F-Secure\Anti-Virus\ - C:\Program Files (x86)\F-Secure\Anti-Virus\ selection_mcafee: ImageLoaded|endswith: - \ashldres.dll - \lockdown.dll - \vsodscpl.dll filter_mcafee: ImageLoaded|startswith: - C:\Program Files\McAfee\ - C:\Program Files (x86)\McAfee\ selection_cyberark: ImageLoaded|endswith: \vftrace.dll filter_cyberark: ImageLoaded|startswith: - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\ - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\ selection_avast: ImageLoaded|endswith: \wsc.dll filter_wsc_dll_avast: ImageLoaded|startswith: - C:\program Files\AVAST Software\Avast\ - C:\program Files (x86)\AVAST Software\Avast\ filter_wsc_dll_avg: ImageLoaded|startswith: - C:\Program Files\AVG\Antivirus\ - C:\Program Files (x86)\AVG\Antivirus\ selection_eset_deslock: ImageLoaded|endswith: \DLPPREM32.dll filter_eset_deslock: ImageLoaded|startswith: - C:\program Files\ESET - C:\program Files (x86)\ESET selection_titanium: ImageLoaded|endswith: \tmdbglog.dll filter_titanium: ImageLoaded|startswith: - C:\program Files\Trend