Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects the MSEdgeUpdateService<GUID> fallback scheduled task that runs a patched conhost.exe (csvchost.exe) headless launch or patched PowerShell (psvchost.exe) to re-fetch CountLoader from C2 every 25 minutes.
Detects creation of WindowsData*.log files directly under the KnownDllPath directory (C:\Windows\System32) by an unsigned process, consistent with Phantom Mantis G13 kernel-assisted EDR killer driver activity.
Detects G13's expanded target discovery via unsigned/non-SYSTEM process enumeration that also covers services, broadening target discovery beyond the original hard-coded security-product process list.
Detects driver IOCTL calls associated with Object Manager callback-based anti-tamper protection combined with CR0.WP manipulation and access-right stripping (PROCESS_TERMINATE/PROCESS_VM_WRITE/PROCESS_DUP_HANDLE) targeting security-product process handles.
Detects G13 kernel driver IOCTL calls used to enumerate and unregister security-vendor minifilter drivers, restricted to unsigned callers targeting known AV/EDR minifilter altitude ranges.
Detects invocation of the G13 killer driver's WipeProcessUserMemory routine via IOCTL 0x221E64, requiring the wipe target be a distinct, identified process from the process that issued the IOCTL.
Detects device I/O control requests carrying IOCTL codes used by the killer driver's process-creation callback to install or apply command-line rewrite rules (native/WOW64 PEB tampering).
Detects a burst of blocked kernel driver-load events on a single host caused specifically by the G11.sys unsigned filtering driver, preventing security agent (re)initialization.
Detects creation/access of a kernel device object or symbolic link whose name is an 8-character hex hash under \Device\ or \DosDevices\, consistent with G12drv.sys date-seeded device naming.
Page 9 of 9