Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
Detects the loading of kernel modules using insmod. Executing this from within a container or unexpected context often indicates abuse of CAP_SYS_MODULE to load malicious rootkits or reverse shells for privilege escalation or container escape.
Detects the loading of known vulnerable drivers commonly abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass Driver Signature Enforcement (DSE) and gain Ring 0 execution.
Detects attempts to load kernel modules using common utilities like 'insmod', 'modprobe', or 'kmod'. This activity can be indicative of an attacker attempting to establish persistence, elevate privileges, or hide malicious activity by loading custom kernel modules.
Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
This rule detects the creation or modification of services, registry keys, or driver loads that exhibit characteristics associated with the ValleyRAT malware. Specifically, it looks for services or registry entries pointing to executables in common temporary directories (Users, ProgramData, Windows AppData\Local\Temp, or \Temp\) and driver loads from similar temporary paths. It also includes a specific check for drivers signed by 'Shandong Anzai Information Technology' and known SHA256 hashes associated with ValleyRAT. The rule excludes legitimate Symantec AV components and a Lenovo signed driver to reduce false positives.
Detects the loading of specific drivers known to be vulnerable and abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level privileges and disable security tools.
Detects the loading of specific vulnerable drivers ('zam64.sys', 'UpdateCheckerX64.sys') used by ransomware groups like CrazyHunter and Interlock to terminate security products. The query combines multiple data sources to detect different stages of BYOVD activity, including driver file creation, registry entries for service creation, and command-line activity related to driver loading.
Identifies the loading of a Linux kernel module from a suspicious, non-standard directory such as /tmp, /dev/shm, /var/tmp, or a user's local hidden directory. Attackers often deploy rootkits and other kernel-level malware from these locations to evade detection and gain persistence. This technique is a prerequisite for kernel-level bypasses like those used by the 'Singularity' rootkit.
Detects the creation or loading of the vulnerable EnCase forensic driver 'OemHwUpd.sys'. This driver is being exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security products.
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Detects loading of kernel modules with insmod command.
Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.
Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.
Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.
Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
Windows Pcap Drivers
Sigma
Detects Windows Pcap driver installation based on a list of associated .sys files.
This rule detects the loading of known vulnerable drivers by their file names. Adversaries often leverage these vulnerable drivers to achieve privilege escalation or persistence on a system, typically by exploiting a known vulnerability in the driver to execute arbitrary code in kernel mode. The list of driver file names included in the detection logic corresponds to drivers identified as vulnerable, often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.
Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.
Detects the loading of known malicious drivers by their MD5, SHA1, SHA256, or IMPHASH. These drivers are often used by adversaries for persistence and privilege escalation, particularly in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to gain kernel-level access.
This rule detects the loading of known malicious drivers by their file names. Adversaries often use malicious drivers for persistence, privilege escalation, or to evade defenses. The rule specifically looks for a predefined list of driver filenames that have been identified as malicious or associated with vulnerable drivers exploited by attackers. This detection is based on the 'ImageLoaded' field, which indicates when a driver is loaded into the system.
Detects attempts to load drivers that have been revoked by Microsoft, as indicated by EventID 3023 in the CodeIntegrity-Operational log. This event signifies that the Windows Code Integrity component has blocked a driver from loading due to its revoked certificate status, which is a critical security measure to prevent malicious or vulnerable drivers from executing on the system.
Detects the load of the WinRing0 driver, which is known to be vulnerable and has been exploited by threat actors, crypto miners (like XMRIG), and other malware for privilege escalation. The detection is based on specific file names or a known IMPHASH associated with the driver.
Page 13 of 19