Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
1
Platforms
2
Products / Services
1
1
MITRE Techniques
2
2
1
1
1
CVEs
71
71
64
58
49
IDS Classtypes
1
Detects the full kill-chain used by modern ransomware operators (RansomHub, LockBit affiliates, BlackCat/ALPHV, FIN7) who deploy EDR killers (EDRKillShifter, AvNeutralizer/AuKill, Terminator, RealBlindingEDR, GhostDriver/Poortry, Backstab) in the pre-encryption phase. These tools use the BYOVD (Bring Your Own Vulnerable Driver) technique — loading a legitimately-signed but vulnerable kernel driver (rtcore64.sys, gdrv.sys, truesight.sys, dbutil_2_3.sys, mhyprot2.sys, procexp152.sys, aswarpot.sys, zam64.sys) as a kernel service, then abusing its IOCTLs to terminate protected EDR processes from kernel space, bypassing PPL. This pack contains 10 queries covering vulnerable driver loads, drivers dropped to user-writable paths, kernel service creation, known EDR-killer binaries, Defender/EDR service tampering, mass security-process termination bursts, unsigned kernel loads, registry-based Defender tampering, full driver→service→kill chain correlation within 1h, and a hash-free behavioural catch-all (unsigned loader → sc.exe create kernel service within 60s).
Detects the loading of the kernel driver associated with the Process Hacker tool. This tool, while legitimate, can be used by adversaries for various malicious activities, including bypassing security controls, inspecting processes, and potentially escalating privileges. The rule identifies the driver by its filename and specific import hashes.
Detects driver load of the Process Hacker tool