Detects blocked load attempts of revoked drivers

Read More

Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Read More

Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Read More

Detects driver load of the Process Hacker tool

Read More

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

Read More

Detects driver load of the System Informer tool

Read More

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Read More

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More

Detects a service installed by a client which has PID 0 or whose parent has PID 0

Read More