Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
176
103
35
17
13
Contributors
101
57
49
42
31
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
346
32
4
1
1
Products / Services
123
84
54
31
25
MITRE Techniques
241
192
169
163
156
CVEs
6
4
2
2
2
This rule detects the loading of a driver by system utilities (drvinst.exe, pnputil.exe, setupapi.dll, or System process) shortly after a PnP (Plug and Play) device connection event. It specifically flags instances where the driver file is located in suspicious directories (Windows/Temp, Users/Public, AppData/Local/Temp) or the file does not have a .sys extension, which are common indicators of malicious driver installation or BYOVD (Bring Your Own Vulnerable Driver) tactics.
This rule detects the loading of a driver by system utilities (drvinst.exe, pnputil.exe, setupapi.dll, or System process) shortly after a PnP (Plug and Play) device connection event. It specifically flags instances where the driver file is located in suspicious directories (Windows/Temp, Users/Public, AppData/Local/Temp) or the file does not have a .sys extension, which are common indicators of malicious driver installation or BYOVD (Bring Your Own Vulnerable Driver) tactics.
This rule detects the loading of kernel-mode drivers that match hashes identified as vulnerable or malicious by the LOLDrivers project. This is a common indicator of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, where adversaries exploit legitimate, signed drivers with known vulnerabilities to gain kernel-mode code execution or elevate privileges.
This rule detects suspicious communication between user-mode processes and kernel-mode drivers using specific Input/Output Control (IOCTL) codes. These IOCTL codes are often associated with known vulnerable drivers that can be exploited for privilege escalation (BYOVD - Bring Your Own Vulnerable Driver) or unauthorized kernel interactions.
Detects the creation of kernel-mode driver services associated with the Phantom Mantis EDR-killer (LARVA-368). The rule monitors for registry modifications to service ImagePath values containing 'drv.sys' for services named 'drvsvc' or 'a', and tracks command-line executions of 'sc.exe' attempting to create kernel services with those same names or paths, indicating unauthorized kernel-mode code execution attempts for security software suppression.
Detects the installation of the srt64.sys kernel driver, associated with the Daxin rootkit. The detection monitors for the creation of this specific file within the System32\drivers directory and the creation of services referencing the driver file.
Detects the loading of the bindflt.sys Windows Minifilter driver, which is associated with Path Virtualization and file system filtering. Monitoring for this driver can identify when virtualization features or specific system isolation mechanisms are initialized.
Detects the creation or modification of a file named 'g11.sys'. This filename is often associated with the deployment of malicious or vulnerable drivers used for kernel-mode exploitation, such as Bring Your Own Vulnerable Driver (BYOVD) attacks or rootkit activity.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
This rule detects tampering with Microsoft Defender by monitoring registry modifications to Image File Execution Options (IFEO) used to attach debuggers to security processes. It also detects the dropping of the 'kvckiller.sys' kernel driver into System32\drivers, which is associated with disabling security software at the kernel level, and the execution of processes containing 'wsftprm' in the command line.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detects the loading of a kernel driver named 'g11.sys', which is associated with the PoisonX campaign, a technique typically used for kernel-level persistence or exploitation.
This rule monitors for the loading of a specific driver file, 'pcdhost.sys', followed by a process termination event within a five-minute window. This behavior is indicative of a 'Bring Your Own Vulnerable Driver' (BYOVD) attack pattern, where an adversary loads a vulnerable driver to gain kernel-level access or elevate privileges, often followed by the cleanup or termination of the process that facilitated the loading.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
Detects the loading of the known vulnerable OPSWAT AppRemover driver (pcdhost.sys). This driver is often abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks, such as those performed by ResiLoader, to execute code in kernel mode and bypass security controls, ultimately allowing the termination of protected security processes.
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
This rule detects the creation of a new .sys driver file outside of standard Windows system directories (System32/drivers, DriverStore, SysWOW64/drivers) followed by the registration or modification of a service in the Windows Registry (CurrentControlSet/Services) within 15 minutes. This pattern is indicative of potential unauthorized driver installation or a Bring Your Own Vulnerable Driver (BYOVD) attack.
This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.
Page 7 of 19