Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,424
11,812
5,870
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
Detects the loading and service creation of the CcProtect/Alinubx kernel driver, a known technique for Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies suspicious characteristics such as file name mismatches, unauthorized product/company signatures, and the creation of services associated with this malicious driver family (e.g., NvFsFilter) to facilitate EDR/AV termination or privilege escalation.
Detects the loading or presence of the Alinubx.sys kernel driver, a malicious component used for Bring Your Own Vulnerable Driver (BYOVD) attacks. This driver facilitates the mass termination of security product processes (AV/EDR) by exposing a specific IOCTL (0x222024) to interface with kernel-mode process termination primitives (e.g., ZwTerminateProcess), often serving as a precursor to the deployment of stealers like Rapuncel.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects the presence of the known vulnerable GIGABYTE driver (gdrv.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass security controls and facilitate kernel-mode execution, as associated with Settra ransomware campaigns.
Detects the loading of the 'gdrv.sys' driver, which is a known vulnerable driver often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to facilitate privilege escalation to kernel mode.
Detects the loading of the 'gdrv.sys' driver, which is a known vulnerable driver often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to facilitate privilege escalation to kernel mode.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
Detects the use of vulnerable kernel drivers, specifically TrueSight.sys and rentdrv2.sys, as part of a Bring Your Own Vulnerable Driver (BYOVD) technique. This activity, associated with DragonForce ransomware, involves registering or accessing these drivers and sending specific IOCTL codes (0x22E044 or 0x22E010) to terminate security software processes.
Detects the creation or renaming of files with an 'ELAM' (Early Launch Anti-Malware) naming convention pattern outside of standard system driver directories, performed by processes that are not verified Microsoft-signed binaries. This may indicate an attempt to install or masquerade as a boot-start driver for persistence or subverting security controls.
Detects the loading and service creation of the CcProtect/Alinubx kernel driver, a known technique for Bring Your Own Vulnerable Driver (BYOVD) attacks. The rule identifies suspicious characteristics such as file name mismatches, unauthorized product/company signatures, and the creation of services associated with this malicious driver family (e.g., NvFsFilter) to facilitate EDR/AV termination or privilege escalation.
This rule detects the potential bypassing of Protected Process Light (PPL) in Windows, characterized by kernel-mode driver activity (such as ObOpenObjectByPointer) correlated with the mass termination of security-related processes (e.g., Defender, CrowdStrike, SentinelOne). The correlation between driver-level object handle manipulation and the termination of protected security binaries is a strong indicator of an adversary attempting to disable EDR/AV protections via kernel exploitation or driver abuse.
Detects the installation and loading of a suspicious driver named 'NvFsFilter' (nvfsflt64.sys), accompanied by registry persistence and suspicious process termination events. This pattern is characteristic of a 'kill-loop' persistence mechanism where malicious drivers or services repeatedly terminate security agents (AV/EDR) to maintain a persistent foothold on the endpoint.
Detects the loading or file presence of known suspicious or potentially malicious kernel drivers, specifically 'alinubx.sys' and 'ccprotect.sys', which are associated with unauthorized system-level activity or potential rootkit behavior.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects the loading or presence of the vulnerable GIGABYTE driver (gdrv.sys), which is frequently exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level access and disable security products. The rule monitors for file artifacts and service creation/execution commands associated with this driver.
Detects the presence of references to the gdrv.sys driver within files or command-line strings. The gdrv.sys driver is a known vulnerable driver frequently exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges and disable endpoint security products.
This rule detects the loading of specific drivers identified as potentially associated with security software evasion or 'Bring Your Own Vulnerable Driver' (BYOVD) tactics, followed by suspicious process termination activity (e.g., termination of security-related processes or system-critical process activity) within a 15-minute window on the same device.
Page 5 of 19