Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
2
2
1
1
1
Platforms
3
Products / Services
1
MITRE Techniques
18,181
15,741
12,668
8,483
6,296
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
Detects the installation of a Windows service associated with an AV/EDR killer tool. The tool uses a driver signed with a known malicious, revoked, or expired certificate to disable security products. This activity has been associated with multiple ransomware families, including RansomHub, Blacksuit, and Medusa.
KQL Query from file: Detecting EDR-killing Tool
