Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
8
6
2
Contributors
8
6
2
Categories
4
3
2
2
2
Platforms
16
Products / Services
6
4
2
2
1
MITRE Techniques
12
7
4
3
2
CVEs
71
71
64
58
49
16
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
The following analytic detects modifications to the BootExecute registry key, which manages applications and services executed during system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute". This activity is significant because unauthorized changes to this key can indicate attempts to achieve persistence, load malicious code, or tamper with the boot process. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code at boot, or disrupt system operations.
The following analytic detects the disabling of Hypervisor-protected Code Integrity (HVCI) by monitoring changes in the Windows registry. It leverages data from the Endpoint datamodel, specifically focusing on registry paths and values related to HVCI settings. This activity is significant because HVCI helps protect the kernel and system processes from tampering by malicious code. If confirmed malicious, disabling HVCI could allow attackers to execute unsigned kernel-mode code, potentially leading to kernel-level rootkits or other severe security breaches.
Detects Windows services that got terminated for whatever reason
Detects important or interesting Windows services that got terminated for whatever reason
Detects issues with Windows Defender Real-Time Protection features
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
The following analytic detects instances of Winlogon.exe, a critical Windows process, connecting to public IP addresses. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on network connections made by Winlogon.exe. Under normal circumstances, Winlogon.exe should not connect to public IPs, and such activity may indicate a compromise, such as the BlackLotus bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level.
This analytic identifies and inventories bootloader paths on Windows endpoints. It uses a PowerShell scripted input to collect this data, which is then processed and aggregated. Monitoring bootloader paths is crucial for detecting unauthorized modifications that could indicate bootkits or other persistent threats. Such malicious activity could allow attackers to maintain persistence, bypass security controls, and potentially control the boot process, leading to full system compromise.
The following analytic detects the disabling of Hypervisor-protected Code Integrity (HVCI) by monitoring changes in the Windows registry. It leverages data from the Endpoint datamodel, specifically focusing on registry paths and values related to HVCI settings. This activity is significant because HVCI helps protect the kernel and system processes from tampering by malicious code. If confirmed malicious, disabling HVCI could allow attackers to execute unsigned kernel-mode code, potentially leading to kernel-level rootkits or other severe security breaches.
The following analytic detects modifications to the BootExecute registry key, which manages applications and services executed during system boot. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "HKLM\\System\\CurrentControlSet\\Control\\Session Manager\\BootExecute". This activity is significant because unauthorized changes to this key can indicate attempts to achieve persistence, load malicious code, or tamper with the boot process. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code at boot, or disrupt system operations.
This rule detects events indicating issues with Windows Defender Real-Time Protection features. Specifically, it triggers when Real-Time Protection encounters an error and fails (EventID 3002) or when a Real-Time Protection feature restarts (EventID 3007). It filters out common false positives related to Network Inspection System errors due to missing updates or unknown antimalware security intelligence issues.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.
This rule detects the termination of important Windows services, such as antivirus, firewall, Microsoft Defender components, BitLocker, and Encrypting File System (EFS). It specifically looks for Event ID 7023 from the 'Service Control Manager' provider, indicating a service termination with an error. The rule identifies critical services by their display names (which can be language-specific) or by their wide hex-encoded service names in the 'Binary' field of the event.