Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects at least two of three macOS profiling subprocess commands (sw_vers -productVersion, system_profiler SPHardwareDataType, ioreg -rd1 -c IOPlatformExpertDevice) spawned by the same parent process within a 2-minute window, consistent with the CountLoader macOS variant's system-profiling routine.
Detects a LaunchAgent plist written to ~/Library/LaunchAgents/ by a non-installer process, correlated with a launchctl load referencing an unsigned/ad hoc binary path within 15 minutes, consistent with the CountLoader macOS variant's persistence mechanism.
Detects rundll32.exe executing a DLL that was written to a user-profile/AppData path within the preceding 15 minutes, consistent with CountLoader's taskType 3 command dispatch downloading and invoking an attacker-specified exported function.
Correlates deletion of a scheduled task via the Schedule.Service COM object within an hour of creation of a suspiciously-named task (GoogleUpdateService, MSEdgeUpdateService, or MicroUpdaterV1), consistent with CountLoader's forensic-evidence cleanup command.
Detects an unsigned process outside standard Windows system directories issuing kernel driver IOCTL 0x2220E4 against three or more distinct target process IDs within a 5-minute window.
Detects processes issuing driver IOCTL codes 0x22208c, 0x222090, or 0x2220c4 associated with the G13 kernel-assisted EDR killer, where the initiating process is unsigned or not signed by a trusted authority.
Detects a full defense-evasion sequence against the drvsvc kernel service and its drv.sys driver: stop, poll, delete, and re-drop occurring within a short time window.
Correlates PowerShell in-memory .NET assembly reflection (System.Reflection.Assembly) with ScriptBlock creation in the same process within a 5-minute window, consistent with CountLoader's reflective payload-loading technique.
Detects CountLoader's taskType 6 command performing a silent MSI installation via msiexec.exe /i /quiet /qn, correlated with a PowerShell parent process or a non-standard (temp/AppData/ProgramData) install source path.
Detects a user-mode process sending IOCTL 0x222418 to a kernel driver to overwrite the file-name buffer in a process's image FILE_OBJECT, spoofing the reported process image path.
Detects a user-mode caller sending IOCTL 0x2220E0 to a loaded kernel driver, triggering an attempted system reset via the 8042 keyboard controller.
Detects CountLoader's taskType 5 command dispatch: a PowerShell script block that downloads content (Invoke-WebRequest/DownloadString) then pipes it to Invoke-Expression with a subsequent main() function call, consistent with fetched reconnaissance modules executed in memory.
Detects a cross-process kernel memory write primitive invoked via IOCTL control code 0x22209C, where the initiating process is unsigned and the write targets a process other than itself.
Detects creation, modification, or renaming of WindowsData*.log files by an unsigned or non-Microsoft-signed process running from System32, consistent with the G13 kernel driver writing XOR-obfuscated log output.
Detects process termination with exit code 99 consistent with the VirIT Agent driver abused by DriverKiller, tightly correlated with presence of the DriverKiller service / Viragtlt device on the host.
Detects multiple G13-related artifacts (anticheatG13.sys, drv.sys, WindowsData*.log) dropped into Windows Temp or drivers directories within a 15-minute window by the same unsigned initiating process.
Correlates installation of the G13 killer driver (drvsvc service, drv.sys/anticheatG13.sys image) with abnormal termination of known security-product processes shortly after, consistent with kernel-initiated memory corruption.
Detects G13 kernel driver IOCTLs that destructively overwrite process memory (0xCC fill pattern) to disable security agent processes, requiring a distinct identified target process.
Detects IOCTL requests to the Phantom Mantis G12/G13 killer driver used for kernel-mode arbitrary file operations (query/read/write/rename), scoped to unsigned callers targeting security-product install directories.
Detects high-frequency enumeration of hard-coded AV/EDR process names via repeated OpenProcess API calls from an initiating process that is unsigned or running outside standard Windows system directories.
Detects CountLoader's C2 beacon sequence: an HTTP GET to /connect carrying XOR-hex-encoded host telemetry and a Bearer token, followed within an hour by a JWT-authenticated getUpdates POST from the same host/destination pair.
Page 8 of 9