Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
This KQL query analyzes driver load events on Windows endpoints to detect malicious activity. It specifically looks for drivers (.sys files) being loaded from non-standard, user-writable directories.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
Detects the loading of the vulnerable RTCore64.sys driver. This driver is exploited by threats like kkRAT to disable AV/EDR security callbacks as part of a Bring Your Own Vulnerable Driver (BYOVD) attack.
The analytic detects the installation of a Linux kernel module using the `modprobe` utility. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
Summary
Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes.
What's New
A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against.
Actionable Threat Data
T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion.
T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.".
T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe.
T1055 - Process Injection: Identify instances of process hollowing
Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes.
What's New
A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against.
Actionable Threat Data
T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion.
T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.".
T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe.
T1055 - Process Injection: Identify instances of process hollowing
Detects the installation of a Windows service associated with an AV/EDR killer tool. The tool uses a driver signed with a known malicious, revoked, or expired certificate to disable security products. This activity has been associated with multiple ransomware families, including RansomHub, Blacksuit, and Medusa.
Detecting LOLDrivers using www.loldrivers.io and MDE telemetry.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
KQL Query from file: Detecting EDR-killing Tool
KQL Query
KQL Query from file: Detecting Windows Side-Loading DLL attacks
KQL Query from file: Threat Hunting BYOVD Scenarios
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query
KQL Query
KQL Query
Detects well-known credential dumping tools execution via service execution events
Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges
Detects the load of known vulnerable drivers via the file name of the drivers.
Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation
Detects the load of known vulnerable drivers via their names only.
Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation
Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows
Page 15 of 19