Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
29
5
5
4
3
Contributors
47
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
40
3
2
2
1
Products / Services
22
8
6
2
2
MITRE Techniques
28
19
14
14
12
CVEs
7
1
1
IDS Classtypes
1
IDS Protocols
1
Detects G13 kernel driver IOCTL calls used to enumerate and unregister security-vendor minifilter drivers, restricted to unsigned callers targeting known AV/EDR minifilter altitude ranges.
Detects invocation of the G13 killer driver's WipeProcessUserMemory routine via IOCTL 0x221E64, requiring the wipe target be a distinct, identified process from the process that issued the IOCTL.
Detects device I/O control requests carrying IOCTL codes used by the killer driver's process-creation callback to install or apply command-line rewrite rules (native/WOW64 PEB tampering).
Detects a burst of blocked kernel driver-load events on a single host caused specifically by the G11.sys unsigned filtering driver, preventing security agent (re)initialization.
Detects creation/access of a kernel device object or symbolic link whose name is an 8-character hex hash under \Device\ or \DosDevices\, consistent with G12drv.sys date-seeded device naming.
Page 3 of 3