Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
7
2
2
1
1
Contributors
4
3
3
1
1
Categories
4
2
2
1
1
Platforms
9
2
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
1
1
Generic rule content from file: TOKYOCORE Wiper Clearing UEFI Secure Boot Keys via PowerShell
Detects when the SSH daemon or associated client binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) are overwritten or newly created on a Linux system. This is a highly suspicious activity often associated with rootkits, backdoors, or persistence mechanisms aimed at intercepting credentials or maintaining unauthorized remote access.
Detects commands used to reflash component firmware for deep persistence
This rule detects attempts to update system firmware from an unverified source. It specifically looks for HTTP traffic (flow:to_client,established) where the URI contains the string "firmware" (case-insensitive) and the file data contains the byte sequence "AA 55". This combination suggests a potential firmware update being delivered over HTTP, which could be malicious if the source is not legitimate.
This rule detects a TFTP (Trivial File Transfer Protocol) boot file request. Specifically, it looks for UDP traffic destined for port 69 (the standard TFTP port) on the home network, containing the byte sequence "|00 01|" at a depth of 2 bytes. This pattern is characteristic of a TFTP read request (opcode 1). The rule's message suggests this could indicate a possible bootkit delivery attempt, as TFTP is often used in network booting scenarios.
Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method
Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section
KQL Query from file: MDE: Detecting Quick Assist Usage
Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method
Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section
Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section
This analytic identifies and inventories bootloader paths on Windows endpoints. It uses a PowerShell scripted input to collect this data, which is then processed and aggregated. Monitoring bootloader paths is crucial for detecting unauthorized modifications that could indicate bootkits or other persistent threats. Such malicious activity could allow attackers to maintain persistence, bypass security controls, and potentially control the boot process, leading to full system compromise.
Detects the creation of a file named "wpbbin.exe" in the "C:\Windows\System32\" directory. This activity can be indicative of a UEFI-based persistence method used by adversaries to maintain access to a system, often by injecting executable files into the boot process, potentially bypassing security measures like BitLocker.
Detects the execution of the 'wpbbin.exe' binary located in 'C:\Windows\System32\'. This binary is associated with a UEFI-based persistence method, as described in the provided references, which allows for the injection of executable files into BitLocker-protected drives.