Browse Rules

Builder_MSIL_G2JS_1 [yara]

The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project.

Builder_MSIL_SharpGenerator_1 [yara]

The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project.

Builder_MSIL_SinfulOffice_1 [yara]

The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project.

Driver Load - bsitf.sys

Detects loading of driver bsitf.sys via name. bsitf.sys and AsusBSItf.sys are ASUS BIOS Flash Driver naming variants distributed with the ASUS WinFlash utility. The 3.2.12.0 AsusBSItf.sys build exposes physical-memory reads through MmMapIoSpace (IOCTL 0x222804), contiguous kernel-memory allocation mapped to user mode through an MDL (IOCTL 0x222808), arbitrary I/O-port writes and reads (IOCTLs 0x222810 and 0x222818), and PCI configuration-space reads with BAR mapping (IOCTL 0x222814). Public rese

Driver Load - bsitf.sys

Detects loading of driver bsitf.sys via hash. bsitf.sys and AsusBSItf.sys are ASUS BIOS Flash Driver naming variants distributed with the ASUS WinFlash utility. The 3.2.12.0 AsusBSItf.sys build exposes physical-memory reads through MmMapIoSpace (IOCTL 0x222804), contiguous kernel-memory allocation mapped to user mode through an MDL (IOCTL 0x222808), arbitrary I/O-port writes and reads (IOCTLs 0x222810 and 0x222818), and PCI configuration-space reads with BAR mapping (IOCTL 0x222814). Public rese

Driver Load - AsusSAIO.sys

Detects loading of driver AsusSAIO.sys via name. ASUS System Analysis IO drivers affected by CVE-2024-55408 expose privileged hardware operations through the \\Device\\ASUSSAIO interface. This 1.0.1.0 build accepts FILE_ANY_ACCESS IOCTLs, including 0x80102074 and 0x80102078, that map caller-selected physical addresses with MmMapIoSpace for read and write operations. The interface also exposes direct I/O-port access without a caller-token authorization check, allowing a local user to cross the us

Driver Load - AsusSAIO.sys

Detects loading of driver AsusSAIO.sys via hash. ASUS System Analysis IO drivers affected by CVE-2024-55408 expose privileged hardware operations through the \\Device\\ASUSSAIO interface. This 1.0.1.0 build accepts FILE_ANY_ACCESS IOCTLs, including 0x80102074 and 0x80102078, that map caller-selected physical addresses with MmMapIoSpace for read and write operations. The interface also exposes direct I/O-port access without a caller-token authorization check, allowing a local user to cross the us

RDP Connection Detection

The [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) (RDP), built in to Microsoft operating systems, allows a user to remotely log in to the desktop of another host. It allows for interactive access of the running windows, and forwards key presses, mouse clicks, etc. Network administrators, power users, and end-users may use RDP for day-to-day operations. From an adversary's perspective, RDP provides a means to [laterally move](https://attack.mitre.org/tactics/TA0008) to

AWS Detective Graph Deleted

Detects the deletion of an Amazon Detective behavior graph via the DeleteGraph API. Amazon Detective automatically collects log data from AWS services and uses machine learning, statistical analysis, and graph theory to build an interactive model of resource behaviors and interactions. Deleting a behavior graph destroys its historical analysis data and removes the ability to investigate security incidents using Detective's relationship mapping. An attacker with sufficient IAM permissions may del