Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
2
Categories
20,444
11,831
5,872
5,155
4,867
Platforms
2
Products / Services
1
1
MITRE Techniques
2
1
1
1
Detects creation of the ':changelist' configuration stream or a feedback (*.dat) stream written onto a .sys driver file itself, distinguishing the abuse pattern (feedback stream on the driver) from legitimate Defender remediation, which writes feedback to a standalone ProgramData path.
Detects the hard-coded RC4 key fragment used by BTR.sys to decrypt its transaction structure when co-located within 0x4000 bytes of the FEE1DEAD magic value and Version 2 header field, targeting the encrypted transaction/ADS payload content independent of driver binary version.