Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
3
1
Categories
2
2
1
1
1
Platforms
3
2
1
Products / Services
2
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects a manual kernel mapper referencing a Fonts-hosted encrypted driver and PE relocation APIs. The rule looks for specific strings often associated with malicious kernel-mode operations, including references to the Windows Fonts directory, and API calls like ZwAllocateVirtualMemory, RtlImageNtHeader, MmGetSystemRoutineAddress, and DriverEntry, which are indicative of dynamic driver loading and PE header manipulation.
KQL Query from file: Threat Hunting BYOVD Scenarios
KQL Query
KQL Query