Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,280 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
Detects the creation of a kernel service pointing to a .sys file located outside the standard Windows system driver directory. This pattern is indicative of a kernel driver being dropped and registered for persistence, a common step in the installation of rootkits or malicious kernel-mode drivers.
This rule correlates the creation of a new .sys file (excluding standard Windows driver directories) with the subsequent execution of sc.exe to register a kernel service. This behavior is indicative of an attacker attempting to load a malicious driver, often for persistence or rootkit capabilities, using a potentially non-standard path.
Detects modifications to Windows boot configuration or registry settings to enable 'testsigning' mode. Enabling testsigning allows for the loading of unsigned drivers or software into the kernel, which is a common technique used by attackers to bypass driver signature enforcement for rootkit or malicious driver deployment.
This rule detects potentially malicious modifications to Windows service registry keys. It monitors the 'Services' registry hive for changes to the 'Start' value to identify services set to start automatically or at boot, or modifications to the 'ImagePath' value that do not conform to expected system-protected paths. This behavior is indicative of an adversary attempting to establish persistence by creating or modifying a malicious service.
Detects two distinct malicious PowerShell behaviors: memory-resident script execution using Base64 and XOR obfuscation, and unauthorized modification of Windows Defender preferences to add exclusions.
Detects modifications to Windows service registry keys (ImagePath, Start, or Type) performed by the native reg.exe or regedit.exe command-line utilities. This behavior is often associated with the creation or modification of services for persistence or privilege escalation.
Detects the installation of a new Windows service using sc.exe from a non-standard parent process (not services.exe) or the installation of a service with an executable path located in suspicious directories such as Temp, AppData, ProgramData, or Users folders.
This rule monitors for the creation of a new .sys file outside of the standard Windows system driver directories (System32 or SysWOW64) within a 15-minute window of a corresponding registry update to the 'ImagePath' of a service. This sequence is indicative of a persistence mechanism involving the installation of a potentially malicious kernel-mode driver, often used by rootkits or malware to achieve high-privilege execution.
Detects instances where files located in root or non-standard paths are opened by processes that are not core Windows system processes or Microsoft security products, which may indicate suspicious activity such as manual file interaction or discovery.
Page 7 of 7