Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
29
5
5
4
3
Contributors
47
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
40
3
2
2
1
Products / Services
22
8
6
2
2
MITRE Techniques
28
19
14
14
12
CVEs
7
1
1
IDS Classtypes
1
IDS Protocols
1
Detects driver-level WFP filter/callout registration at network-redirection-relevant layers that can be used to redirect or interfere with security-vendor network traffic (G12 capability).
Detects G12clean.exe creating a kernel driver file (drv.sys or anticheatG13.sys) while its own command line references the XOR key 0xAB, consistent with decoding and dropping an obfuscated driver payload.
Detects cross-process memory copy activity via IOCTL code 0x2220C8 or the MmCopyVirtualMemory kernel routine, associated with the Phantom Mantis G13 EDR-killer driver.
Detects mass file renaming (ransomware-style encryption behavior) within 30 minutes after execution of Phantom Mantis EDR-killer tooling, indicating endpoint defenses were pinned immediately before ransomware deployment.
Detects embedded diagnostic banner and debug strings from Phantom Mantis G12/G13 EDR killer tools, requiring a unique tool banner alongside a debug string to reduce false positives.
Detects an unsigned process outside standard Windows system directories issuing kernel driver IOCTL 0x2220E4 against three or more distinct target process IDs within a 5-minute window.
Detects processes issuing driver IOCTL codes 0x22208c, 0x222090, or 0x2220c4 associated with the G13 kernel-assisted EDR killer, where the initiating process is unsigned or not signed by a trusted authority.
Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.
Detects the DriverKiller BYOVD loader and its embedded vulnerable TG Soft VirIT Agent driver (CVE-2017-17472) by requiring the leftover PDB path artifact together with a known SHA-256 hash match, rather than either indicator alone, to avoid matching legitimate VirIT Agent installations or unrelated files containing only a subset of the indicators
Detects a user-mode process sending IOCTL 0x222418 to a kernel driver to overwrite the file-name buffer in a process's image FILE_OBJECT, spoofing the reported process image path.
Detects a user-mode caller sending IOCTL 0x2220E0 to a loaded kernel driver, triggering an attempted system reset via the 8042 keyboard controller.
Detects a cross-process kernel memory write primitive invoked via IOCTL control code 0x22209C, where the initiating process is unsigned and the write targets a process other than itself.
Detects creation, modification, or renaming of WindowsData*.log files by an unsigned or non-Microsoft-signed process running from System32, consistent with the G13 kernel driver writing XOR-obfuscated log output.
Detects process termination with exit code 99 consistent with the VirIT Agent driver abused by DriverKiller, tightly correlated with presence of the DriverKiller service / Viragtlt device on the host.
Detects multiple G13-related artifacts (anticheatG13.sys, drv.sys, WindowsData*.log) dropped into Windows Temp or drivers directories within a 15-minute window by the same unsigned initiating process.
Correlates installation of the G13 killer driver (drvsvc service, drv.sys/anticheatG13.sys image) with abnormal termination of known security-product processes shortly after, consistent with kernel-initiated memory corruption.
Detects G13 kernel driver IOCTLs that destructively overwrite process memory (0xCC fill pattern) to disable security agent processes, requiring a distinct identified target process.
Detects IOCTL requests to the Phantom Mantis G12/G13 killer driver used for kernel-mode arbitrary file operations (query/read/write/rename), scoped to unsigned callers targeting security-product install directories.
Detects the observable effect of G13's driver entry-point patch capability: repeated Service Control Manager STATUS_ACCESS_DENIED failures starting the same targeted kernel driver.
Detects creation of WindowsData*.log files directly under the KnownDllPath directory (C:\Windows\System32) by an unsigned process, consistent with Phantom Mantis G13 kernel-assisted EDR killer driver activity.
Detects driver IOCTL calls associated with Object Manager callback-based anti-tamper protection combined with CR0.WP manipulation and access-right stripping (PROCESS_TERMINATE/PROCESS_VM_WRITE/PROCESS_DUP_HANDLE) targeting security-product process handles.
Page 2 of 3