Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
9
3
3
2
Contributors
5
4
3
2
2
Categories
11
7
1
1
1
Platforms
10
3
3
1
1
Products / Services
5
3
3
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
1
1
IDS Protocols
2
1
This rule monitors for suspicious interactions with Android device drivers via the 'getevent' utility, often used to capture raw input, combined with unusual file access patterns involving 'locateValues.json' and potential data exfiltration attempts to specific internal API endpoints.
Detects the execution of 'driverquery.exe' to enumerate information about the 'npf.sys' driver (Network Packet Filter), which is associated with Npcap/WinPcap used for packet capture. The rule specifically monitors when this command is launched by non-standard parent processes like 'report.bin' or 'nw.exe', which may indicate malicious reconnaissance or network monitoring tools.
Detects the execution of 'driverquery.exe' to enumerate information about the 'npf.sys' driver (Network Packet Filter), which is associated with Npcap/WinPcap used for packet capture. The rule specifically monitors when this command is launched by non-standard parent processes like 'report.bin' or 'nw.exe', which may indicate malicious reconnaissance or network monitoring tools.
Detects the execution of 'driverquery.exe' to enumerate information about the 'npf.sys' driver (Network Packet Filter), which is associated with Npcap/WinPcap used for packet capture. The rule specifically monitors when this command is launched by non-standard parent processes like 'report.bin' or 'nw.exe', which may indicate malicious reconnaissance or network monitoring tools.
Detects the execution of 'driverquery.exe' to enumerate information about the 'npf.sys' driver (Network Packet Filter), which is associated with Npcap/WinPcap used for packet capture. The rule specifically monitors when this command is launched by non-standard parent processes like 'report.bin' or 'nw.exe', which may indicate malicious reconnaissance or network monitoring tools.
Detects enumeration of device drivers for security product discovery
Detects enumeration of device drivers for security product discovery
This rule detects attempts to enumerate device drivers on a system via a web shell. It specifically looks for HTTP requests containing the string "driverquery" in the URI, which is a command-line utility on Windows systems used to display a list of installed device drivers and their properties. The detection is case-insensitive and targets established HTTP connections to the server.
This rule detects attempts to query the list of system drivers on a remote Windows host via a WMI session over SMB (port 445). The detection is based on the presence of the string "Win32_SystemDriver" in the network traffic, indicating a WMI query for system driver information. This activity can be indicative of reconnaissance by an attacker.
This rule detects the delivery of a kernel driver enumeration tool via HTTP. Specifically, it looks for the string "EnumDeviceDrivers" (case-insensitive) within HTTP response data flowing to a client. This string is indicative of tools or malware attempting to enumerate loaded kernel drivers, which is a common reconnaissance technique used by attackers.
In this query, we are looking for emails containing malware accessed on a unmanaged device
This query searches for not onboarded devices with a specific Suffix
The following analytic identifies the use of the 'lsmod' command to list kernel modules on a Linux system. This detection leverages data from Linux Auditd, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
The analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
Detects the execution of the "driverquery" utility, which can be used by adversaries to perform reconnaissance on installed drivers. This rule specifically looks for 'driverquery.exe' or 'drvqry.exe' as the image or original filename.
This rule detects the execution of 'driverquery.exe' or 'drvqry.exe' when initiated by specific parent processes or from suspicious directories. The parent processes include scripting engines like cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Additionally, the rule flags execution where the parent process image path contains common temporary or user-writable directories such as 'AppData\Local\', 'Users\Public\', or 'Windows\Temp\'. This combination aims to identify reconnaissance activity where an attacker is attempting to enumerate installed drivers on a system, potentially as part of a larger compromise, often associated with malware like Ursnif.