Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Summary
Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes.
What's New
A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against.
Actionable Threat Data
T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion.
T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.".
T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe.
T1055 - Process Injection: Identify instances of process hollowing
Sophisticated EDR (Endpoint Detection and Response) killer tools are increasingly being used by various ransomware groups to disable security solutions, allowing them to operate undetected during multi-stage attacks. These tools, often packed with services like HeartCrypt, leverage compromised code-signing certificates and vulnerable drivers to gain kernel-level access and terminate security processes.
What's New
A significant new finding is the widespread adoption and apparent sharing of these EDR killer tools, often customized and packed with HeartCrypt, across numerous competing ransomware groups including RansomHub, Blacksuit, Medusa, Qilin, Dragonforce, Crytox, Lynx, and INC. This suggests a concerning trend of technical knowledge transfer and tool sharing within the ransomware ecosystem, making these attacks more pervasive and challenging to defend against.
Actionable Threat Data
T1562.001 - Impair Defenses: Disable or Modify Tools: Monitor for the creation of new services with randomly generated five-character names, especially those associated with .sys files, as these are indicative of malicious driver installation for EDR evasion.
T1036.005 - Masquerading: Match Legitimate Name or Location: Look for executables that masquerade as legitimate software (e.g., by injecting malicious code into legitimate utilities like Beyond Compare) and attempt to load drivers signed with revoked or expired certificates from entities like "Changsha Hengxiang Information Technology Co., Ltd." or "Fuzhou Dingxin Trade Co., Ltd.".
T1562.001 - Impair Defenses: Disable or Modify Tools: Detect attempts to terminate security-related processes such as MsMpEng.exe, SophosHealth.exe, SAVService.exe, sophosui.exe, sepwscsvc64Exe, sepagentExe, SophosOsqueryExtension.exe, SophosNetFilter.exe, SophosScanCoordinator.exe, SophosUpdate.exe, HitmanPro.Alert.exe, HitmanPro.exe, HmpschedExe, mpcmdrunExe, and NissrvExe.
T1055 - Process Injection: Identify instances of process hollowing
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.
Detects when a Group Policy Object (GPO) is modified to include Client-Side Extensions (CSEs) for managing local group memberships or user rights assignments. While this can be a legitimate administrative action, attackers can abuse this capability to escalate privileges by adding accounts to sensitive local groups (e.g., Administrators) or granting powerful user rights. This alert serves as an early warning to investigate the specific changes made within the GPO.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
This detects looks for the creation of scheduled tasks where the task content explicitly references a temporary file within the user's AppData\Local\Temp directory. This activity has been observed by AgentTesla as persistence mechanisms attempting to execute from a temporary location.
Detects the keylogger component (WinMainSvc.dll) used by the Crypto24 ransomware group for persistence via Windows Services.
Detects the installation of a Windows service associated with an AV/EDR killer tool. The tool uses a driver signed with a known malicious, revoked, or expired certificate to disable security products. This activity has been associated with multiple ransomware families, including RansomHub, Blacksuit, and Medusa.
Detects when an application or service principal performs sensitive configuration changes, likely via the Microsoft Graph API. This can indicate an attacker using a compromised or malicious application for persistence (adding credentials), privilege escalation (adding owners), or defense evasion (modifying Conditional Access policies). This aligns with the "Consent & Compromise" research where attackers abuse application permissions.
Detects a process opening a handle to a thread with rights to set the thread's context. This is a key indicator of thread hijacking techniques, where an adversary manipulates a waiting thread in a legitimate process to execute malicious code.
KQL Query designed to detected tactics employed during active exploitation of WinRAR Zero-Day ( CVE-2025-8088)
Detects the addition of a new Federated Domain within Microsoft 365 audit logs. This activity can be a legitimate administrative action but also indicates potential federated credential abuse or the establishment of a backdoor via federated identities.
Detects suspicious service installation scripts
Detect possible ADCS ESC4 privilege escalation using Certipy's default template hijacking. This detects a change of the security descriptor on a certificate template granting full control to the Authenticated Users group. Event ID 4886 and 4898 will typically also be generated at the same time. Afterwards, Event ID 4886 and 4887 may appear to indicate a certificate request as a high-privilege user in the UPN field.
Detects the simultaneous modification of 'msDS-ManagedAccountPrecededByLink' and 'msDS-DelegatedMSAState' attributes on a delegated Managed Service Account (dMSA) object. This activity is a strong indicator of the BadSuccessor privilege escalation technique, where an attacker simulates a dMSA migration to impersonate a target account.
Detects a specific Donut-generated shellcode sample based on its SHA256 hash. This shellcode is known to employ techniques like position-independent code to execute .NET assemblies.
This rule detects the presence and activity of PAM-based backdoors on Linux systems by looking for specific SHA256 hashes and filenames associated with known PAM backdoors. It monitors process events, general device events, file events, and image load events on Linux devices.
Detects a position-independent code (PIC) technique commonly used in shellcode, such as that generated by the Donut tool. This technique uses a 'call $+5' followed by a 'pop' to determine the current instruction pointer's address.
Page 285 of 401