Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
Detects the creation or loading of a driver named Havoc.sys in a temporary directory, or the loading of a known vulnerable Huawei audio driver (HWAuidoOs2Ec.sys) identified by its SHA256 hash. This activity is indicative of the Havoc Process Terminator BYOVD tool, often used in recent campaigns to blind EDR solutions.
Detects the loading of the K7RKScan.sys driver, which has been associated with CVE-2025-1055 and used in 'Bring Your Own Vulnerable Driver' (BYOVD) campaigns, specifically mentioning Backdoor.Turn. This activity can be indicative of privilege escalation or defense evasion.
This rule detects the creation or loading of a .sys file (kernel driver) within the Windows Fonts directory by a non-standard loader. This behavior is suspicious as the Fonts directory is not a typical location for kernel drivers, and the use of common command-line interpreters (cmd, powershell, pwsh, rundll32, regsvr32) or other executables to stage or load such files indicates potential malicious activity, possibly related to defense evasion or persistence.
Detects the usage of Fox Tempest certificates to sign and load malicious .sys drivers into the Windows kernel space to blind EDR. The rule specifically looks for signed .sys files being loaded from temporary or downloads folders.
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
Identifies the EDR killer utility actively tampering with the Windows Defender registry keys (DisableAntiSpyware, DisableRealtimeMonitoring) after kernel access is achieved. This rule specifically looks for modifications to the 'DisableAntiSpyware' or 'DisableRealtimeMonitoring' registry values under the Windows Defender policy key, setting them to '1' (enabled/disabled respectively), and correlates this with the loading of a '.sys' driver file by the same initiating process.
Detects the loading of known vulnerable or unsigned drivers, specifically targeting Huawei-signed driver variants, which have been leveraged by DragonForce for Bring Your Own Vulnerable Driver (BYOVD) defense evasion. The rule identifies driver loads where the file name matches known vulnerable Huawei drivers or where the driver is loaded by an unusual process and not from a standard system directory, and is also untrusted.
This rule detects attempts to load kernel drivers using command-line utilities such as infinstall.exe, devcon.exe, pnputil.exe, or sc.exe. The detection specifically looks for these commands being initiated by powershell.exe, cmd.exe, or ServertoolLauncher.exe, which could indicate malicious activity like ransomware attempting to establish persistence or evade defenses.
Detects the loading of the 'wsftprm.sys' driver, which has been associated with CVE-2023-52271 and abused by ransomware groups to terminate security processes. This rule specifically looks for 'wsftprm.sys' in DeviceImageLoadEvents.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
Correlates the dropping of the vulnerable driver with sc.exe creating a kernel-level service to load it into memory.
This rule correlates the successful loading of the 'EEDbg.sys' driver with subsequent command-line activity indicating an attempt to stop a service or delete the 'EEDbg.sys' file. This behavior is indicative of an attacker cleaning up forensic evidence after a Bring Your Own Vulnerable Driver (BYOVD) attack, specifically targeting the EnCase EDR's driver.
Identifies the EDR Killer successfully removing driver callbacks or notify routines in kernel memory by detecting a sudden cessation of telemetry following the driver load of 'EEDbg.sys'. This rule correlates driver load events with subsequent telemetry drops from the same device.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
Detects anomalous user-mode processes requesting the SeLoadDriverPrivilege token privilege, which is essential for loading the EnCase driver (EEDbg.sys) into the kernel. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack using the EnCase driver.
This rule detects attempts by user-mode utilities to interact with the loaded EnCase driver via DeviceIoControl, specifically targeting paths containing 'EEDbg' or 'EnCase'. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack, where an EDR killer utility leverages a legitimate driver's functionality to execute arbitrary ring-0 commands, potentially bypassing security controls.
This rule detects suspicious command-line activity indicative of direct kernel object manipulation, often associated with kernel-mode rootkits. It looks for processes executing commands containing keywords related to direct kernel access (e.g., 'directl', 'kernel call', 'ntoskrnl', 'hal.dll') in conjunction with keywords suggesting privilege escalation or driver loading (e.g., 'setprivileges', 'loaddriver', 'createremotethread'). Such combinations can signify attempts to install or interact with malicious kernel drivers or rootkits.
Detects potentially malicious drivers masquerading as Palo Alto components, specifically looking for drivers loaded from the 'drivers' folder that claim to be from 'Palo Alto' but have no signer or an invalid signature. This behavior has been associated with the ABYSSWORKER threat.
Detects the use of legitimate administrative tools (regsvcs.exe, infinstall.exe, devcon.exe) being executed with command-line arguments indicative of driver or kernel-level installations (e.g., 'kernel', 'ring0', 'driver install'). This behavior is commonly associated with the installation of rootkits or the execution of Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges.
Page 11 of 19