Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
12
6
3
1
1
Contributors
6
2
2
2
2
Categories
14
11
5
3
3
Platforms
20
4
3
2
Products / Services
10
4
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
IDS Classtypes
1
IDS Protocols
1
Detects potential malicious and unauthorized usage of bcdedit.exe
The following analytic detects instances of Winlogon.exe, a critical Windows process, connecting to public IP addresses. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on network connections made by Winlogon.exe. Under normal circumstances, Winlogon.exe should not connect to public IPs, and such activity may indicate a compromise, such as the BlackLotus bootkit attack. This detection is significant as it highlights potential system integrity breaches. If confirmed malicious, attackers could maintain persistence, bypass security measures, and compromise the system at a fundamental level.
This analytic identifies and inventories bootloader paths on Windows endpoints. It uses a PowerShell scripted input to collect this data, which is then processed and aggregated. Monitoring bootloader paths is crucial for detecting unauthorized modifications that could indicate bootkits or other persistent threats. Such malicious activity could allow attackers to maintain persistence, bypass security controls, and potentially control the boot process, leading to full system compromise.
This rule detects potential malicious and unauthorized usage of 'bcdedit.exe' by monitoring process creation events. Specifically, it looks for 'bcdedit.exe' being executed with command-line arguments related to deleting boot entries or values, importing boot data, or enabling safe boot with network capabilities. Such commands can be indicative of ransomware attempting to tamper with the Master Boot Record (MBR) or other boot configurations to prevent system startup or establish persistence, or other forms of bootkit activity.
Yara rule that detects KillDisk ransomware.
Page 2 of 2