tool
DCRAT is a variant of the open-source AsyncRAT developed in C# with additional capabilities such as patching Microsoft’s Antimalware Scan Interface (AMSI).[1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
17th percentile · 83% of 825 ATT&CK software entries have more Enterprise techniques.
41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
4th percentile · 96% of 825 ATT&CK software entries have more detection rules per technique.
55th percentile · 55% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 4 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
297 distinct rules cover the 4 techniques recorded for this tool. 168 Sigma · 129 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects the modification of the findings on SecurityHub. | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | high | Sittikorn S | 2021-06-28 | — | a607e1fe-74bf-4440-a3ec-b059b9103157 | ||||
Splunk | The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2023-11-16 | 2026-05-13 | 875de3d7-09bc-4916-8c0a-0929f4ced3d8 | |||
Detects when Events are deleted in Azure Kubernetes. (...) | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-07-24 | 2022-08-23 | 225d8b09-e714-479c-a0e4-55e6f29adf35 | ||||
Detects changes to the bitbucket audit log configuration. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 6aa12161-235a-4dfb-9c74-fe08df8d8da1 | ||||
Detects Bitbucket global secret scanning rule deletion activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 | ||||
Detects Bitbucket global SSH access configuration changes. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 16ab6143-510a-44e2-a615-bdb80b8317fc | ||||
Detects when a secret scanning allowlist rule is added for projects. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 | ||||
Detects when a repository is exempted from secret scanning feature. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | high | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | b91e8d5e-0033-44fe-973f-b730316f23a1 | ||||
Detects when secret scanning rule is deleted for the project or repository. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | ff91e3f0-ad15-459f-9a85-1556390c138d | ||||
Splunk | Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. (...) | Hunting | stable | firewall | - | Cisco Secure Firewall · Cisco | medium | Bhavin Patel, Micheal Haag, Splunk | 2025-09-25 | 2026-05-13 | 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4 | ||||
Splunk | This analytic detects the disabling of logging functionality on a Cisco ASA device
through CLI comma (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk | 2025-09-25 | 2026-05-13 | 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201 | |||
Splunk | This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | b87b48a8-6d1a-4280-9cf1-16a950dbf901 | |||
Splunk | This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...) | Hunting | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | f52d5c0b-d45d-4304-b300-a4f6a1130dec | ||||
Turn off logging locally or remote | Generic | test | authentication | - | Cisco AAA · Cisco | - | high | Austin Clark | 2019-08-11 | 2023-01-04 | 9e8f6035-88bf-4a63-96b6-b17c0508257e | ||||
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. (...) | Generic | experimental | authentication | - | Cisco AAA · Cisco | - | medium | Luc Génaux | 2026-04-28 | — | ef0ff092-a24a-4fbc-beea-06c08d53e085 | ||||
Splunk | This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | e20a6709-5f2c-4508-83fb-b3af6f705717 | |||
Splunk | This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | a01ca274-16cb-476d-a814-d2ffe29d8905 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Bhavin Patel, Nasreddine Bencherchali, Splunk | 2025-05-12 | 2026-09-22 | b71e57e8-c571-4ff1-ae13-bc4384a9e891 | |||
Splunk | This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 66f22f52-fbae-4be7-a263-561dacb63613 | |||
Splunk | This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 66f22f52-fbae-4be7-a263-561dacb63612 | |||
Splunk | This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...) | Anomaly | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | b0ce5521-2533-4f24-b8d5-c2ff977aae08 | ||||
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Matt Anderson, Dray Agha, Anna Pham (Huntress) | 2026-01-02 | — | 85f520e7-6f5e-43ca-874c-222e5bf9c0de | ||||
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during (...) | Emerging | test | registry_event | windows | Sysmon · WinEventLog Security | high | Nasreddine Bencherchali (Nextron Systems) | 2023-10-24 | — | 9f9f92ba-5300-43a4-b435-87d1ee571688 | |||||
Splunk | The following analytic detects modifications to the Windows registry that disable the Antimalware Scan Interface (AMSI) by setting the "AmsiEnable" value to "0x00000000". (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-06-23 | 2026-05-13 | 9c27ec42-d338-11eb-9044-acde48001122 | |||
Splunk | The following analytic detects the modification of Windows Defender registry settings to disable antivirus and antispyware protections. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-18 | 2026-06-08 | aa4f695a-3024-11ec-9987-acde48001122 | |||
Splunk | The following analytic detects the modification of the Windows registry to disable the Windows Defender BlockAtFirstSeen feature. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-18 | 2026-05-13 | 2dd719ac-3021-11ec-97b4-acde48001122 | |||
Splunk | The following analytic detects the modification of the registry to disable Windows Defender's Enhanced Notification feature. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-18 | 2026-05-13 | dc65678c-301f-11ec-8e30-acde48001122 | |||
Splunk | The following analytic detects the modification of the Windows Defender MpEngine registry value, specifically setting MpEnablePus to 0x00000000. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-18 | 2026-05-13 | cc391750-3024-11ec-955a-acde48001122 | |||
Splunk | The following analytic detects the modification of the registry to disable Windows Defender SpyNet reporting. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-18 | 2026-05-13 | 898debf4-3021-11ec-ba7c-acde48001122 | |||
Splunk | The following analytic detects the modification of the Windows registry to disable the Windows Defender Submit Samples Consent feature. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-18 | 2026-06-08 | 73922ff8-3022-11ec-bf5e-acde48001122 | |||
Splunk | The following analytic detects modifications to the registry that disable the Event Tracing for Windows (ETW) feature. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-06-23 | 2026-10-02 | f0eacfa4-d33f-11eb-8f9d-acde48001122 | |||
Detects disabling Windows Defender Exploit Guard Network Protection | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Austin Songer @austinsonger | 2021-08-04 | 2023-08-17 | bf9e1387-b040-4393-9851-1598f8ecfae9 | ||||
Detects usage of powershell cmdlets to disable or remove ETW trace sessions | Generic | test | ps_script | windows | PowerShell | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-06-28 | 2026-10-12 | 115fdba9-f017-42e6-84cf-d5573bf2ddf8 | ||||
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-09-15 | 2025-03-18 | de25eeb8-3655-4643-ac3a-b662d3f26b6b | ||||
Detects registry modifications that disable Privacy Settings Experience | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-10-02 | 2023-08-17 | 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b | ||||
Detects disabling Windows Defender PUA protection | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Austin Songer @austinsonger | 2021-08-04 | 2023-08-17 | 8ffc5407-52e3-478f-9596-0a7371eafe13 |