UTMSTACK logoUTMSTACK logo
Antivirus Bitdefender GravityZone

Detection rules for Bitdefender GravityZone data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 20 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Persistent Threat (APT) DetectionCommand and ControlTA0011 - Application Layer ProtocolC:3 / I:3 / A:2
Antivirus Service Stopped or DisabledDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:2 / I:3 / A:3
Bitdefender AV Policy WeakenedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Bitdefender Console Used for Lateral MovementLateral MovementT1072 - Software Deployment ToolsC:3 / I:3 / A:3
Bitdefender GravityZone High Severity Threat DetectionExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
Bitdefender GravityZone Quarantine Failure DetectionDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Bitdefender GravityZone Suspicious Exclusion AddedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:1
Bitdefender GravityZone Zero-Day Malware DetectionExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:2
Bootkit/UEFI Threat DetectionDefense Evasion, PersistenceT1542.001 - Boot or Logon Autostart Execution: System FirmwareC:3 / I:3 / A:3
Crypto-Mining DetectionImpactT1496 - Resource HijackingC:2 / I:2 / A:3
Email-Based Threat SpreadingInitial AccessT1566 - PhishingC:3 / I:3 / A:2
Fileless Malware DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:2 / I:2 / A:2
Malware Outbreak Detection - Multiple Hosts InfectedCommand and ControlT1105 - Ingress Tool TransferC:3 / I:3 / A:3
Memory-Based Threat DetectionDefense Evasion, Privilege EscalationT1055 - Process InjectionC:3 / I:3 / A:2
Multiple Malware Detections from Single SourceCommand and ControlT1105 - Ingress Tool TransferC:3 / I:3 / A:2
Network-Based Threat DetectionCommand and ControlT1071 - Application Layer Protocol: Command and ControlC:3 / I:2 / A:3
Ransomware Behavior DetectionImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Real-time Protection DisabledDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
Rootkit DetectionDefense EvasionT1014 - RootkitC:3 / I:3 / A:2
USB-Based Malware PropagationLateral Movement, Initial AccessT1091 - Replication Through Removable MediaC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Advanced Persistent Threat (APT) Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - antivirus-bitdefender-gz
name: Advanced Persistent Threat (APT) Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Command and Control
technique: "TA0011 - Application Layer Protocol"
adversary: origin
references:
  - https://www.bitdefender.com/business/support/en/77212-237089-event-types.html
  - https://attack.mitre.org/tactics/TA0011/
description: |
  Detects indicators of Advanced Persistent Threats including targeted attacks, sophisticated malware, and persistent threats detected by Bitdefender GravityZone's HyperDetect module.
  
  Next Steps:
  - Investigate the affected endpoint to determine the scope of compromise
  - Review process execution history and network connections from the affected system
  - Check for lateral movement by examining authentication logs from the same source IP
  - Isolate the affected system if active threat is confirmed
  - Collect forensic artifacts including memory dumps and event logs
  - Search for similar malware indicators across the environment
  - Review user account activities for signs of credential compromise
  - Contact security operations center if threat actors match known APT groups
where: |
  equals("log.product", "Bitdefender GravityZone") &&
  greaterOrEqual("log.severity", 8) &&
  (
    contains("log.eventType", ["apt", "targeted", "advanced", "persistent", "hyperdetect"]) ||
    contains("log.restData", ["apt", "targeted attack", "advanced persistent",
      "lazarus", "equation", "sofacy", "cozy bear", "fancy bear",
      "panda", "kitten", "carbanak", "fin7", "fileless"]) ||
    equals("log.signatureID", "hyperdetect")
  ) &&
  exists("log.hostId")
groupBy:
  - lastEvent.log.eventType
  - lastEvent.log.hostId

Rule Details

Advanced Persistent Threat (APT) Detection

Detects indicators of Advanced Persistent Threats including targeted attacks, sophisticated malware, and persistent threats detected by Bitdefender GravityZone's HyperDetect module.

Antivirus Service Stopped or Disabled

Detects when the Bitdefender antivirus service or critical security modules are stopped, disabled, or experiencing failures. This is a critical security event that could indicate malicious tampering or system issues.

Bitdefender AV Policy Weakened

Detects when Bitdefender GravityZone antivirus policies are weakened by administrators, such as disabling real-time protection, reducing scan aggressiveness, or adding broad exclusions. This could indicate a compromised admin account or insider threat.

Bitdefender Console Used for Lateral Movement

Detects when the Bitdefender GravityZone management console is potentially being used to push malicious policies, scripts, or tasks to managed endpoints, indicating a compromised admin account being leveraged for lateral movement.

Bitdefender GravityZone High Severity Threat Detection

Detects high-severity malware threats identified by Bitdefender GravityZone that require immediate attention. This rule triggers on severity levels 8-10, which indicate critical threats such as trojans, ransomware, rootkits, or other advanced malware.

Bitdefender GravityZone Quarantine Failure Detection

Detects when Bitdefender GravityZone fails to quarantine detected malware. This could indicate that the malware is actively resisting remediation attempts or that there are permission issues preventing proper quarantine.

Bitdefender GravityZone Suspicious Exclusion Added

Detects when exclusions are added to Bitdefender GravityZone that may allow malware to operate undetected. Attackers often add exclusions to antivirus software to prevent detection of their malicious tools and activities.

Bitdefender GravityZone Zero-Day Malware Detection

Detects potential zero-day malware identified by Bitdefender's advanced threat detection capabilities including HyperDetect and Sandbox Analyzer. These detection methods use behavioral analysis and machine learning to identify previously unknown threats.

Bootkit/UEFI Threat Detection

Detects bootkit or UEFI-level threats that attempt to persist at the firmware level and compromise the boot process. These threats can survive system reinstalls and bypass traditional security measures by infecting the system firmware.

Crypto-Mining Detection

Detects cryptocurrency mining activities including miners, coin miners, and cryptojacking attempts detected by Bitdefender GravityZone.

Email-Based Threat Spreading

Detects email-based malware spreading including phishing attempts, malicious attachments, and email-borne threats through Bitdefender's Exchange protection. This rule triggers on Exchange-specific malware events and monitors for patterns of email-based threats.

Fileless Malware Detection

Detects fileless malware attacks including PowerShell-based attacks, memory injection, and living-off-the-land techniques using Bitdefender GravityZone's HyperDetect and Command-Line Scanner modules. These attacks execute malicious code directly in memory without writing to disk, making them harder to detect with traditional antivirus.

Malware Outbreak Detection - Multiple Hosts Infected

Detects when the same malware signature or threat is detected on multiple endpoints within a short time window. This pattern indicates a potential malware outbreak spreading across the network environment.

Memory-Based Threat Detection

Detects memory-based threats including process injection, memory manipulation, and fileless malware executing in memory based on Bitdefender GravityZone event types.

Multiple Malware Detections from Single Source

Detects when multiple malware threats are detected on a single host within a short time period. This could indicate a compromised system actively spreading malware or an attacker launching multiple malware variants.

Network-Based Threat Detection

Detects network-based threats including C2 communications, malicious network activity, and suspicious network connections identified by Bitdefender GravityZone.

Ransomware Behavior Detection

Detects ransomware behavior patterns including file encryption attempts, mass file modifications, and ransomware-specific malware types detected by Bitdefender GravityZone.

Real-time Protection Disabled

Detects when real-time protection features are disabled on an endpoint. This is a critical security event as it leaves the system vulnerable to malware infections and requires immediate investigation.

Rootkit Detection

Detects rootkit infections and kernel-level threats that attempt to hide malicious activity at the system level using Bitdefender GravityZone's advanced detection capabilities.

USB-Based Malware Propagation

Detects USB-based malware propagation attempts including autorun infections, removable media threats, and device control violations. This rule monitors for device control events and removable media access patterns that may indicate malware attempting to spread via USB devices.