Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects an unsigned process outside standard Windows system directories issuing kernel driver IOCTL 0x2220E4 against three or more distinct target process IDs within a 5-minute window.
Detects processes issuing driver IOCTL codes 0x22208c, 0x222090, or 0x2220c4 associated with the G13 kernel-assisted EDR killer, where the initiating process is unsigned or not signed by a trusted authority.
Detects mass file renaming (ransomware-style encryption behavior) within 30 minutes after execution of Phantom Mantis EDR-killer tooling, indicating endpoint defenses were pinned immediately before ransomware deployment.
Detects a user-mode caller sending IOCTL 0x2220E0 to a loaded kernel driver, triggering an attempted system reset via the 8042 keyboard controller.
Detects process termination with exit code 99 consistent with the VirIT Agent driver abused by DriverKiller, tightly correlated with presence of the DriverKiller service / Viragtlt device on the host.
Correlates installation of the G13 killer driver (drvsvc service, drv.sys/anticheatG13.sys image) with abnormal termination of known security-product processes shortly after, consistent with kernel-initiated memory corruption.
Detects G13 kernel driver IOCTLs that destructively overwrite process memory (0xCC fill pattern) to disable security agent processes, requiring a distinct identified target process.
Detects IOCTL requests to the Phantom Mantis G12/G13 killer driver used for kernel-mode arbitrary file operations (query/read/write/rename), scoped to unsigned callers targeting security-product install directories.
Detects the observable effect of G13's driver entry-point patch capability: repeated Service Control Manager STATUS_ACCESS_DENIED failures starting the same targeted kernel driver.
This rule detects the execution of processes associated with G12/G13 EDR-killer tools. These tools are specifically designed to automate the termination of security software, antivirus solutions, and remote management processes, which is a common tactic used by adversaries to evade detection and maintain persistence.
Detects malicious PowerShell activity attempting to bypass the Antimalware Scan Interface (AMSI) by identifying command-line patterns associated with 'CountLoader' and similar malware. It targets the use of .NET reflection to manipulate AmsiUtils fields and the use of dynamic function resolution (D/Invoke) techniques via GetDelegateForFunctionPointer and GetProcAddress to evade static detection.
Detects creation of WindowsData*.log files directly under the KnownDllPath directory (C:\Windows\System32) by an unsigned process, consistent with Phantom Mantis G13 kernel-assisted EDR killer driver activity.
Detects driver IOCTL calls associated with Object Manager callback-based anti-tamper protection combined with CR0.WP manipulation and access-right stripping (PROCESS_TERMINATE/PROCESS_VM_WRITE/PROCESS_DUP_HANDLE) targeting security-product process handles.
Detects G13 kernel driver IOCTL calls used to enumerate and unregister security-vendor minifilter drivers, restricted to unsigned callers targeting known AV/EDR minifilter altitude ranges.
Detects a Perl process acquiring and holding an exclusive file lock on the XProtect signature database (XPdb) to prevent macOS security-signature updates from being written to disk.
Generic rule content from file: Windows Defender Disabled via PowerShell/sc.exe (TOKYOCORE pre-wipe)
Detects a repeated/looped termination pattern against the CloudTelemetryService process, matching XCSSET's continuous loop that blocks security telemetry from reaching Apple.
Detects a Perl process acquiring and holding an exclusive file lock on the XProtect signature database (XPdb) to prevent macOS security-signature updates from being written to disk.
Detects a burst of blocked kernel driver-load events on a single host caused specifically by the G11.sys unsigned filtering driver, preventing security agent (re)initialization.
Detects a repeated/looped termination pattern against the CloudTelemetryService process, matching XCSSET's continuous loop that blocks security telemetry from reaching Apple.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Page 2 of 60