Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
This rule monitors for indicators of compromise (IOCs) associated with the Rapuncel/Cruciferra 'Bring Your Own Vulnerable Driver' (BYOVD) malware-as-a-service (MaaS) campaign. It detects malicious file hashes (associated with dropped binaries or drivers), connections to known malicious command-and-control (C2) IP addresses, and network requests to domains used by the infrastructure.
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
This rule identifies potential persistence activity on a Windows host by correlating multiple indicators such as service creation, scheduled tasks, registry run key modifications, Winlogon helper modifications, and driver loading. It specifically monitors for indicators associated with 'NetSupport' or 'client32' filenames or services. The rule triggers when two or more distinct persistence mechanisms are detected for the same host and user.
This rule detects the execution, file presence, or driver loading associated with 'EDRKiller' and 'WarsawKiller', which are malicious tools used to terminate or disable endpoint security products.
Detects the loading of known vulnerable kernel drivers 'truesight.sys' or 'rentdrv2.sys'. These drivers are frequently abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attack chains, where attackers leverage specific IOCTL calls (such as 0x22E044 or 0x22E010) to interact with the driver to perform privileged actions, such as terminating security processes.
This rule detects activities related to the loading or registration of the 'NvFsFilter' driver (nvfsflt64.sys). It monitors for command-line attempts to interact with services (using sc.exe, reg.exe, or services.exe), registry modifications involving the NvFsFilter service, and the actual loading of the nvfsflt64.sys file. This is intended to identify potential persistence mechanisms or the deployment of potentially unauthorized or malicious drivers.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Detects evidence of the Alinubx.sys kernel driver being loaded or interacted with via its device interface using a specific IOCTL (0x222024). This driver is known to be abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software processes from kernel mode, effectively bypassing Windows Protected Process Light (PPL) protections.
Detects the mass termination of multiple security-related processes on a host within a short timeframe, correlated with the presence of specific driver modules potentially associated with security software interference or evasive behavior.
Detects the loading or installation of specific NVIDIA file system filter drivers ('Alinubx.sys', 'CcProtect.sys', 'nvfsflt64.sys') or services related to the 'NvFsFilter'. These drivers are associated with NVIDIA driver components; however, they can be targeted for unauthorized usage or mimicry.
This rule detects potential security software tampering by identifying the loading of a specific driver (Alinubx.sys) followed by the termination or interference of common security agent processes within a short timeframe. This behavior is indicative of an adversary attempting to disable endpoint protection using a Bring Your Own Vulnerable Driver (BYOVD) or malicious driver approach.
Detects signs of NetSupport Manager (client32.exe) establishing multiple persistence mechanisms simultaneously or in quick succession, including Windows service creation, Winlogon helper registration, Registry Run key modification, scheduled task creation, and keyboard filter driver installation. This behavior is indicative of unauthorized use of remote access tools to maintain persistence on a host.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
This rule detects the loading of specific drivers identified as potentially associated with security software evasion or 'Bring Your Own Vulnerable Driver' (BYOVD) tactics, followed by suspicious process termination activity (e.g., termination of security-related processes or system-critical process activity) within a 15-minute window on the same device.
This rule detects the loading of specific drivers identified as potentially associated with security software evasion or 'Bring Your Own Vulnerable Driver' (BYOVD) tactics, followed by suspicious process termination activity (e.g., termination of security-related processes or system-critical process activity) within a 15-minute window on the same device.
Detects the loading of the 'gdrv.sys' driver, which is a known vulnerable driver often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to facilitate privilege escalation to kernel mode.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
Page 4 of 19