synoti logosynoti logo
Antivirus Kaspersky

Detection rules for Kaspersky Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 19 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Code Injection Attempt DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
Kaspersky Agent Disabled or TamperedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
Kaspersky Application Privilege Escalation DetectionDefense Evasion, Privilege EscalationT1055/T1134 - Process Injection and Access Token ManipulationC:3 / I:3 / A:2
Kaspersky Command and Control Communication DetectionCommand and ControlT1071 - Application Layer ProtocolC:3 / I:3 / A:2
Kaspersky Critical Object DetectionExecutionT1204 - User Execution: Malicious FileC:3 / I:3 / A:2
Kaspersky Data Exfiltration Attempts DetectionExfiltrationT1048 - Exfiltration Over Alternative ProtocolC:3 / I:2 / A:1
Kaspersky Ransomware Behavior DetectionImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Kaspersky Rootkit DetectionDefense EvasionT1014 - RootkitC:3 / I:3 / A:3
Kaspersky Sandbox Evasion Attempts DetectionDefense Evasion, DiscoveryT1497 - Virtualization/Sandbox EvasionC:3 / I:3 / A:2
Kaspersky Suspicious Network Activity DetectionCommand and ControlT1071 - Application Layer ProtocolC:3 / I:2 / A:2
Kaspersky Suspicious Scheduled Tasks DetectionExecution, Persistence, Privilege EscalationT1053 - Scheduled Task/JobC:3 / I:3 / A:2
Kaspersky Suspicious Service Installation DetectionPersistence, Privilege EscalationT1543.003 - Create or Modify System Process: Windows ServiceC:2 / I:2 / A:2
Kaspersky System File Tampering DetectionDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:1
Kaspersky Trusted Application Compromise DetectionDefense EvasionT1218 - Signed Binary Proxy ExecutionC:3 / I:3 / A:2
Kaspersky WMI Abuse DetectionExecutionT1047 - Windows Management InstrumentationC:3 / I:3 / A:2
Lateral Movement Indicators DetectionLateral MovementT1021 - Remote ServicesC:3 / I:3 / A:2
Living Off the Land Binaries (LOLBins) Abuse DetectionDefense EvasionT1218 - System Binary Proxy ExecutionC:3 / I:3 / A:2
Process Hollowing DetectionDefense Evasion, Privilege EscalationT1055.012 - Process Injection: Process HollowingC:3 / I:3 / A:2
Suspicious Packed Executable DetectionDefense EvasionT1027.002 - Obfuscated Files or Information: Software PackingC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Code Injection Attempt Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-kaspersky
name: Code Injection Attempt Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Defense Evasion, Privilege Escalation
technique: "T1055 - Process Injection"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1055/
  - https://support.kaspersky.com/KESWin/11/en-us/151065.htm
description: |
  Detects attempts to inject malicious code into legitimate processes. This technique is commonly used by malware to evade detection and gain elevated privileges by running within trusted processes.
  
  Next Steps:
  1. Immediately isolate the affected system to prevent lateral movement
  2. Identify the source process that attempted the injection
  3. Check if the malware was successfully quarantined or if manual removal is needed
  4. Review system logs for any suspicious activities around the same timeframe
  5. Scan the system with updated antivirus definitions
  6. Check for persistence mechanisms (scheduled tasks, registry keys, services)
  7. Review network connections from the affected host for C2 communications
  8. Consider reimaging the system if critical processes were compromised
where: |
  (regexMatch("log.msg", "(?i).*(inject|injection|CreateRemoteThread|SetWindowsHookEx|WriteProcessMemory).*") ||
   (contains("log.cs4", ["inject", "hooking", "trojan", "backdoor"]) && 
    contains("action", ["terminate", "delete", "quarantine"]))) &&
  contains("log.msg", ["lsass", "csrss", "winlogon", "services", "svchost", "explorer"])
deduplicateBy:
  - origin.host
  - log.cs4

Rule Details

Code Injection Attempt Detection

Identifies efforts to insert malicious code into trusted processes. Malware frequently uses this method to avoid detection and obtain elevated privileges by executing inside legitimate processes.

Kaspersky Agent Disabled or Tampered

Detects disabling, stopping, or tampering with the Kaspersky security agent. This serves as a key sign of defense evasion, since attackers turn off endpoint protection to run malware without being noticed.

Kaspersky Application Privilege Escalation Detection

Identifies attempts to raise privileges through application manipulation, process injection, or unauthorized permission elevation monitored by Kaspersky endpoint protection. These methods are often used by attackers to acquire higher-level permissions on compromised systems.

Kaspersky Command and Control Communication Detection

Detects possible command and control (C2) communication attempts flagged by Kaspersky, such as suspicious outbound connections, malware callbacks, and botnet communication patterns. This rule fires when Kaspersky detects network threats tied to botnet activity, C2 communications, or malware beaconing that was not blocked successfully.

Kaspersky Critical Object Detection

Detects critical threats identified by Kaspersky, such as malware, trojans, or other dangerous objects needing immediate attention. High-severity detections often point to active threats.

Kaspersky Data Exfiltration Attempts Detection

Detects possible data exfiltration attempts flagged by Kaspersky through suspicious network traffic patterns, large data transfers, or connections to suspicious external destinations. This rule watches for network threats, trojan/backdoor detections, and suspicious data transfer patterns that could signal data exfiltration.

Kaspersky Ransomware Behavior Detection

Detects ransomware behavior patterns identified by Kaspersky, such as mass file encryption, ransom note creation, and malware classifications specific to ransomware.

Kaspersky Rootkit Detection

Detects rootkit activity identified by Kaspersky security, such as hidden processes, kernel-level modifications, and rootkit-specific malware classifications that point to a deeply compromised system.

Kaspersky Sandbox Evasion Attempts Detection

Identifies malware that tries to detect and evade sandbox environments. This covers time-based evasion, environment checks, anti-VM techniques, and other behaviors intended to avoid analysis in controlled environments.

Kaspersky Suspicious Network Activity Detection

Detects suspicious network activities, such as unusual connections, possible C2 communications, or network-based attacks identified by Kaspersky security monitoring. This rule triggers when Kaspersky blocks network connections matching suspicious patterns and multiple similar events originate from the same host.

Kaspersky Suspicious Scheduled Tasks Detection

Detects suspicious scheduled task creation or modification identified by Kaspersky, potentially indicating persistence mechanisms used by malware or attackers. Attackers commonly abuse scheduled tasks to maintain persistence, run malicious code at set times, or escalate privileges.

Kaspersky Suspicious Service Installation Detection

Detects suspicious attempts to install or modify Windows services identified by Kaspersky, which could point to malware persistence mechanisms or privilege escalation attempts. Service manipulation is a common technique malware uses to maintain persistence on compromised systems.

Kaspersky System File Tampering Detection

Detects efforts to tamper with critical system files, Windows services, or protected system components. This covers unauthorized changes to system binaries, service configurations, or attempts to manipulate security-critical files.

Kaspersky Trusted Application Compromise Detection

Identifies when legitimate or trusted applications show malicious behavior, potentially signaling compromise or exploitation. This includes detecting signed binaries used for malicious purposes or trusted processes performing suspicious activities. This is a critical security event indicating an attacker may be using living-off-the-land techniques to evade detection.

Kaspersky WMI Abuse Detection

Detects possible Windows Management Instrumentation (WMI) abuse identified by Kaspersky, such as suspicious WMI queries, event subscriptions, or process creation through WMI. WMI is a legitimate Windows component that attackers often abuse for lateral movement, persistence, and code execution.

Lateral Movement Indicators Detection

Detects signs of lateral movement attempts across the network via Kaspersky antivirus logs.
Attackers use various techniques including PSExec, WMI, RDP, SMB shares, and exploitation tools to move
from one compromised system to others, extending their access and control across the network. This rule
identifies blocked or detected activities that could point to lateral movement attempts.

Living Off the Land Binaries (LOLBins) Abuse Detection

Identifies when legitimate Windows system binaries, known as LOLBins, are used maliciously to execute harmful code. Adversaries exploit these trusted utilities to evade security controls and sustain persistence. LOLBins pose a serious risk since they are Microsoft-signed binaries that most security tools trust.

Process Hollowing Detection

Detects process hollowing attempts in which malware launches a new process in a suspended state, unmaps its memory, and substitutes it with malicious code. This sophisticated method is used to avoid detection by concealing malicious code inside legitimate processes.

Suspicious Packed Executable Detection

Detects instances where Kaspersky flags suspicious packed executables, which malware commonly employs to avoid detection and analysis. Packed executables rely on compression or encryption to conceal their actual content and make reverse engineering more difficult.