Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
4
2
Contributors
4
1
1
Categories
2
1
1
1
1
Platforms
6
1
Products / Services
4
2
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects modifications to the Boot Configuration Data (BCD) using bcdedit.exe that could indicate an attempt to disable recovery options, enable safe boot with networking, or ignore boot failures. This activity can be indicative of persistence mechanisms, bootkit installation, or attempts to hinder system recovery.
Detects attempts to load drivers that have been revoked by Microsoft, as indicated by EventID 3023 in the CodeIntegrity-Operational log. This event signifies that the Windows Code Integrity component has blocked a driver from loading due to its revoked certificate status, which is a critical security measure to prevent malicious or vulnerable drivers from executing on the system.
Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
Detects when Code Integrity identifies and blocks the loading of an image (DLL, EXE, etc.) that has a revoked digital certificate. This indicates an attempt to load untrusted or malicious code, potentially bypassing security controls. Event ID 3035 specifically notes cases where the image is allowed to load due to a kernel mode debugger being attached, which is a highly suspicious activity.
Detects the loading of an unsigned kernel module on a Windows system, which can indicate attempts to bypass security controls, establish persistence, or escalate privileges. This event is logged by Windows Code Integrity when it determines that a kernel module without a valid digital signature is being loaded.
This rule detects events where Windows Code Integrity blocks a file because it is disallowed for protected processes. This indicates an attempt to load or execute an unauthorized file within a protected process environment, which could be a sign of privilege escalation or an attempt to bypass security controls.