Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
12
6
3
1
1
Contributors
6
2
2
2
2
Categories
14
11
5
3
3
Platforms
20
4
3
2
Products / Services
10
4
3
1
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
IDS Classtypes
1
IDS Protocols
1
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects execution of BlackX UEFI bootkit installer components, renamed helper binaries acting as payloads (such as jcef_helper.exe renamed to googleupdate.exe), or known malicious file hashes associated with BlackX campaigns.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Detects potential bootkit activity or unauthorized modifications to the EFI system partition by correlating non-standard .efi file writes with subsequent execution of boot configuration utilities like bcdedit or mountvol within a 30-minute window.
Detects the use of 'bootsect.exe' with parameters specifically designed to overwrite the Master Boot Record (MBR) and the targeting or modification of 'winload.efi', which is indicative of destructive boot-level attacks or bootkit deployment attempts.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
This rule monitors for two critical firmware-related conditions: detected non-compliance with secure boot, UEFI, or TPM configuration standards via Microsoft Defender TVM, and explicit firmware or boot configuration change events reported by device telemetry. It is designed to identify potential tampering or misconfigurations that could facilitate bootkits or other pre-OS persistence mechanisms.
Generic rule content from file: TOKYOCORE Wiper Clearing UEFI Secure Boot Keys via PowerShell
Detects suspicious modifications to Windows Boot Configuration Data (BCD) using bcdedit.exe by unsigned or non-standard processes outside defined maintenance windows. This behavior is associated with the Dolphin X malware's bootkit persistence module, designed to gain control before the operating system initializes.
Detects TFTP-based pre-boot file transfers for bootkit or firmware persistence
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
This rule detects modifications to critical boot sector files (bootsect, bootmgr, BOOTCODE, MBR) on the C: or X: drives. It specifically looks for these modifications when initiated by processes other than common system processes like 'system', 'csrss.exe', or 'explorer.exe'. The rule counts modifications within one-hour bins and triggers if one or more modifications are observed.
This rule detects modifications to critical boot sector files (bootsect, bootmgr, BOOTCODE, MBR) on the C: or X: drives. It specifically looks for these modifications when initiated by processes other than common system processes like 'system', 'csrss.exe', or 'explorer.exe'. The rule counts modifications within one-hour bins and triggers if one or more modifications are observed.
This rule detects TFTP (Trivial File Transfer Protocol) requests for bootloader files. Specifically, it looks for UDP traffic on port 69 (the standard TFTP port) where the packet content starts with the byte sequence "00 01". This pattern is characteristic of a TFTP read request for a file, often used in network booting scenarios to retrieve bootloader files. The rule flags this activity as a "Possible Pre-OS Persistence" mechanism, suggesting an adversary might be attempting to establish persistence before the operating system fully loads, potentially through techniques like bootkits or modifying boot records.
This rule detects attempts to modify GRUB configuration files using common text editors. Adversaries may modify GRUB configuration to establish persistence, disable security features, or alter the boot process for malicious purposes.
Detects potential malicious and unauthorized usage of bcdedit.exe
Detects modifications to the Boot Configuration Data (BCD) using bcdedit.exe that could indicate an attempt to disable recovery options, enable safe boot with networking, or ignore boot failures. This activity can be indicative of persistence mechanisms, bootkit installation, or attempts to hinder system recovery.
Detects attempts to execute the 'dsmain' utility with specific flags (-e, -d, -g) used by RESURGE for AES encryption/decryption of the coreboot RAM disk or to extract the vmlinux kernel image on Ivanti Connect Secure devices.
The rule detects the execution of bcdedit.exe with command-line arguments containing both "testsigning" and "on".
Detects attempts to replace the legitimate UEFI bootloader (bootmgfw.efi) with a malicious one by creating a backup (.old file) and modifying the original. This is a critical persistence technique used by the HybridPetya ransomware.
Detects potential malicious and unauthorized usage of bcdedit.exe
Page 1 of 2