synoti logosynoti logo
Antivirus Bitdefender GravityZone

Detection rules for Bitdefender GravityZone Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 20 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Persistent Threat (APT) DetectionCommand and ControlTA0011 - Application Layer ProtocolC:3 / I:3 / A:2
Antivirus Service Stopped or DisabledDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:3
Bitdefender AV Policy WeakenedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Bitdefender Console Used for Lateral MovementLateral MovementT1072 - Software Deployment ToolsC:3 / I:3 / A:3
Bitdefender GravityZone High Severity Threat DetectionExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
Bitdefender GravityZone Quarantine Failure DetectionDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Bitdefender GravityZone Suspicious Exclusion AddedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:1
Bitdefender GravityZone Zero-Day Malware DetectionExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:2
Bootkit/UEFI Threat DetectionDefense Evasion, PersistenceT1542.001 - Boot or Logon Autostart Execution: System FirmwareC:3 / I:3 / A:3
Crypto-Mining DetectionImpactT1496 - Resource HijackingC:2 / I:2 / A:3
Email-Based Threat SpreadingInitial AccessT1566 - PhishingC:3 / I:3 / A:2
Fileless Malware DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:2 / I:2 / A:2
Malware Outbreak Detection - Multiple Hosts InfectedCommand and ControlT1105 - Ingress Tool TransferC:3 / I:3 / A:3
Memory-Based Threat DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
Multiple Malware Detections from Single SourceCommand and ControlT1105 - Ingress Tool TransferC:3 / I:3 / A:2
Network-Based Threat DetectionCommand and ControlT1071 - Application Layer Protocol: Command and ControlC:3 / I:2 / A:3
Ransomware Behavior DetectionImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Real-time Protection DisabledDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Rootkit DetectionDefense EvasionT1014 - RootkitC:3 / I:3 / A:2
USB-Based Malware PropagationLateral Movement, Initial AccessT1091 - Replication Through Removable MediaC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Advanced Persistent Threat (APT) Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-bitdefender-gz
name: Advanced Persistent Threat (APT) Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Command and Control
technique: "TA0011 - Application Layer Protocol"
adversary: origin
references:
  - https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
  - https://attack.mitre.org/tactics/TA0011/
description: |
  Detects indicators of Advanced Persistent Threats including targeted attacks, sophisticated malware, and persistent threats detected by Bitdefender GravityZone's HyperDetect module.
  
  Next Steps:
  - Investigate the affected endpoint to determine the scope of compromise
  - Review process execution history and network connections from the affected system
  - Check for lateral movement by examining authentication logs from the same source IP
  - Isolate the affected system if active threat is confirmed
  - Collect forensic artifacts including memory dumps and event logs
  - Search for similar malware indicators across the environment
  - Review user account activities for signs of credential compromise
  - Contact security operations center if threat actors match known APT groups
where: |
  equals("log.product", "Bitdefender GravityZone") &&
  greaterOrEqual("log.severity", 8) &&
  (
    contains("log.eventType", ["apt", "targeted", "advanced", "persistent", "hyperdetect"]) ||
    contains("log.restData", ["apt", "targeted attack", "advanced persistent",
      "lazarus", "equation", "sofacy", "cozy bear", "fancy bear",
      "panda", "kitten", "carbanak", "fin7", "fileless"]) ||
    equals("log.signatureID", "hyperdetect")
  ) &&
  exists("log.hostId")
groupBy:
  - lastEvent.log.eventType
  - lastEvent.log.hostId

Rule Details

Advanced Persistent Threat (APT) Detection

Identifies indicators of Advanced Persistent Threats, including targeted attacks, sophisticated malware, and persistent threats found by Bitdefender GravityZone's HyperDetect module.

Antivirus Service Stopped or Disabled

Identifies when the Bitdefender antivirus service or essential security modules are stopped, disabled, or failing. This critical security event may indicate malicious tampering or system problems.

Bitdefender AV Policy Weakened

Identifies when administrators weaken Bitdefender GravityZone antivirus policies, such as by disabling real-time protection, reducing scan aggressiveness, or adding broad exclusions. This may point to a compromised admin account or an insider threat.

Bitdefender Console Used for Lateral Movement

Identifies potential use of the Bitdefender GravityZone management console to push malicious policies, scripts, or tasks to managed endpoints, indicating a compromised admin account is being leveraged for lateral movement.

Bitdefender GravityZone High Severity Threat Detection

Identifies high-severity malware threats found by Bitdefender GravityZone that require immediate attention. This rule fires on severity levels 8-10, which indicate critical threats such as trojans, ransomware, rootkits, or other advanced malware.

Bitdefender GravityZone Quarantine Failure Detection

Identifies when Bitdefender GravityZone cannot quarantine detected malware. This may indicate the malware is actively resisting remediation attempts or that permission issues are preventing proper quarantine.

Bitdefender GravityZone Suspicious Exclusion Added

Identifies when exclusions are added to Bitdefender GravityZone that could allow malware to operate undetected. Attackers often add exclusions to antivirus software to keep their malicious tools and activities from being detected.

Bitdefender GravityZone Zero-Day Malware Detection

Identifies potential zero-day malware found by Bitdefender's advanced threat detection capabilities, including HyperDetect and Sandbox Analyzer. These detection methods rely on behavioral analysis and machine learning to uncover previously unknown threats.

Bootkit/UEFI Threat Detection

Identifies bootkit or UEFI-level threats that seek to persist in firmware and compromise the boot process. By infecting system firmware, these threats can withstand system reinstalls and evade traditional security measures.

Crypto-Mining Detection

Identifies cryptocurrency mining activities, including miners, coin miners, and cryptojacking attempts detected by Bitdefender GravityZone.

Email-Based Threat Spreading

Identifies email-based malware spreading, including phishing attempts, malicious attachments, and email-borne threats, through Bitdefender's Exchange protection. This rule fires on Exchange-specific malware events and monitors for patterns of email-based threats.

Fileless Malware Detection

Bitdefender GravityZone's HyperDetect and Command-Line Scanner modules identify fileless malware attacks, such as PowerShell-based attacks, memory injection, and living-off-the-land techniques. Because these attacks run malicious code directly in memory and avoid writing to disk, they are more difficult for traditional antivirus to detect.

Malware Outbreak Detection - Multiple Hosts Infected

Identifies when the same malware signature or threat appears on multiple endpoints in a brief time window. This pattern points to a possible malware outbreak spreading through the network environment.

Memory-Based Threat Detection

Identifies memory-based threats, including process injection, memory manipulation, and fileless malware executing in memory, based on Bitdefender GravityZone event types.

Multiple Malware Detections from Single Source

Identifies when multiple malware threats appear on one host within a brief time period. This may point to a compromised system actively spreading malware or an attacker deploying multiple malware variants.

Network-Based Threat Detection

Identifies network-based threats, including C2 communications, malicious network activity, and suspicious network connections identified by Bitdefender GravityZone.

Ransomware Behavior Detection

Identifies ransomware behavior patterns, including file encryption attempts, mass file modifications, and ransomware-specific malware types detected by Bitdefender GravityZone.

Real-time Protection Disabled

Identifies when real-time protection features are disabled on an endpoint. This critical security event leaves the system vulnerable to malware infections and requires immediate investigation.

Rootkit Detection

Identifies rootkit infections and kernel-level threats that attempt to hide malicious activity at the system level using Bitdefender GravityZone's advanced detection capabilities.

USB-Based Malware Propagation

Identifies attempts to propagate USB-based malware, such as autorun infections, removable media threats, and device control violations. This rule monitors device control events and removable media access patterns that could point to malware attempting to spread through USB devices.