Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
2
1
1
Categories
2
1
1
1
1
Platforms
4
1
Products / Services
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
KQL Query
MosaicLoader
KQL
This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.