Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
147 detections
Filters
Last updated
All Time
Detection languages
83
19
15
8
7
Contributors
35
27
17
14
10
Categories
64
35
29
24
21
Platforms
98
50
2
2
Products / Services
39
23
14
11
10
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
The analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. It identifies drivers not located in typical directories like Windows, Program Files, or SystemRoot. This activity is significant because adversaries may use these non-standard paths to load malicious or vulnerable drivers, potentially bypassing security controls. If confirmed malicious, this could allow attackers to execute code at the kernel level, escalate privileges, or maintain persistence within the environment, posing a severe threat to system integrity and security.
This KQL query analyzes driver load events on Windows endpoints to detect malicious activity. It specifically looks for drivers (.sys files) being loaded from non-standard, user-writable directories.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
This YARA rule detects the Pumakit rootkit on Linux systems. It identifies specific byte patterns associated with the rootkit's syscall hooking mechanisms, including patterns related to hooking `rmdir` and `gdents64` functions. The rule looks for these distinct code sequences within executable files to indicate the presence of the Pumakit rootkit.
Detects host-based artifacts of the Tomcat remote Kernel Backdoor, specifically the communication between the LKM and the userland component via the /proc/acpi/pcicard file.
The analytic detects the installation of a Linux kernel module using the `modprobe` utility. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
Yara rule that detects Pumakit rootkit.
KQL Query
The analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value where it is set to "1" to disable the Hypervisor Enforced Paging Translation feature. This action can be taken by adversaries to evade detection by security tools that rely on this feature for monitoring or integrity checks, potentially facilitating kernel exploits or rootkit installations.
This analytic detects the insertion of a Linux kernel module using the `insmod` utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
The following analytic identifies the use of the 'lsmod' command to list kernel modules on a Linux system. This detection leverages data from Linux Auditd, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
The analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.
This analytic detects the creation of new files within the Linux kernel/driver directory. This activity is significant because this directory is typically reserved for kernel modules, and unauthorized file creation here can indicate a rootkit installation. If confirmed malicious, this could allow an attacker to gain high-level privileges, potentially compromising the entire system by executing code at the kernel level.
This analytic detects the creation of new .sys files on disk. It leverages the Endpoint.Filesystem data model to identify and log instances where .sys files are written to the filesystem. This activity is significant because .sys files are often used as kernel mode drivers, and their unauthorized creation can indicate malicious activity such as rootkit installation. If confirmed malicious, this could allow an attacker to gain kernel-level access, leading to full system compromise, persistent control, and the ability to bypass security mechanisms.
The following analytic detects the insertion of a Linux kernel module using the insmod utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.
The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). It leverages fields such as driver path, signature status, and hash to detect potentially suspicious drivers. This activity is significant for a SOC as malicious drivers can be used to gain kernel-level access, bypass security controls, or persist in the environment. If confirmed malicious, this activity could allow an attacker to execute arbitrary code with high privileges, leading to severe system compromise and potential data exfiltration.
This rule detects relevant ClamAV messages indicating the presence of various types of malware. It specifically looks for keywords like 'Trojan*FOUND', 'VirTool*FOUND', 'Webshell*FOUND', 'Rootkit*FOUND', and 'Htran*FOUND' in ClamAV logs. These keywords suggest that ClamAV has identified and reported a malicious file or component.
This rule detects the execution of specific commands associated with the installation of the Triple Cross eBPF rootkit. It looks for commands executed via 'sudo' that contain specific 'tc' (traffic control) parameters, including 'qdisc' and 'filter', along with a network interface like 'enp0s3'. These command line arguments are characteristic of the 'deployer.sh' script used by the Triple Cross rootkit to establish persistence and hide its presence using eBPF.
Detects the creation of a service named 'ZzNetSvc' which is associated with the Moriya rootkit, as described in the 'Operation TunnelSnake' report by Securelist. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in the 'C:\Windows\System32\drivers\' directory. This specific filename is associated with the Moriya rootkit, as detailed in the Securelist's "Operation TunnelSnake" report. The presence of this file indicates a potential rootkit installation attempt, which could lead to persistence and privilege escalation on a Windows system.
Page 7 of 7