Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or configure a service named 'TaskHandler'. The rule specifically looks for command lines that reference potentially malicious files like 'F7u00ex.exe' or specific driver/restart patterns often associated with the persistence mechanism of the Spark RAT.
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or configure a service named 'TaskHandler'. The rule specifically looks for command lines that reference potentially malicious files like 'F7u00ex.exe' or specific driver/restart patterns often associated with the persistence mechanism of the Spark RAT.
Detects the installation or creation of a Windows service related to RustDesk, a remote access software application. This may indicate unauthorized installation or persistence setup of remote control tools by an adversary.
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
Detects the creation and enablement of a systemd unit file that uses a deceptive description ('Apache HTTPD Cache Manager') and the 'Restart=always' directive. This pattern is characteristic of persistence mechanisms used by the Evooo1Bot malware, which attempts to maintain continuous execution by running as a system service.
Detects the creation and configuration of a Windows service named 'media_updaten' via command-line utilities (sc.exe) or direct registry modification. This service is associated with CoolClient for persistence to relaunch 'Sang.exe' with a 'work' parameter.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
Detects signs of Cloudflared tunnel persistence on Windows endpoints, specifically targeting service registration (via sc.exe or registry modifications) and the presence of the cloudflared.exe binary. This is often used by attackers to maintain outbound-only access to compromised machines following exploitation of vulnerabilities like CVE-2026-18577.
Detects post-exploitation persistence artifacts on Windows endpoints managed by N-able N-central consistent with abuse of CVE-2026-18577, including a new Windows service named Cloudflared, registry Services key creation for Cloudflared, a file named svchost.exe written under a user's Documents folder, or process execution of cloudflared.exe or a Documents-located svchost.exe.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
Detects redundant persistence mechanisms associated with the CornFlake RAT by identifying the creation of Windows services, registry run keys, and scheduled tasks that reference a binary named svchost32.exe located outside of the standard C:\Windows\System32 directory, often masquerading as a 'Cloud Sync Service'.
Detects the creation of a Windows service named 'svchost32' with a display name of 'Cloud Sync Service' via administrative command-line utilities like sc.exe, PowerShell, or cmd.exe. This activity is a known persistence mechanism for the CornFlake RAT, which masquerades as a legitimate system process to evade detection.
Detects the execution of PsExec.exe in correlation with the installation of the PSEXESVC service on the same host within a 15-minute timeframe. The rule includes an allowlist filter for authorized administrative accounts to minimize alerts for legitimate infrastructure management.
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
Detects the creation of kernel-mode driver services associated with the Phantom Mantis EDR-killer (LARVA-368). The rule monitors for registry modifications to service ImagePath values containing 'drv.sys' for services named 'drvsvc' or 'a', and tracks command-line executions of 'sc.exe' attempting to create kernel services with those same names or paths, indicating unauthorized kernel-mode code execution attempts for security software suppression.
Detects the creation of a Windows service using 'sc.exe' with names or command-line indicators associated with legitimate Windows update services, a technique commonly used by the TOKYOCORE malware for persistence.
Detects the creation of a malicious Windows service named 'WinUpdateSvc' with the display name 'Windows Update Service Helper' using sc.exe. This activity is a documented persistence mechanism for the TOKYOCORE ransomware, which executes the binary 'fsociety.exe' with SYSTEM privileges.
Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)
This query helps to identify service creation events regardless of the tool/method used for service creation (even if the threat actors use the Windows API directly, without leaving any command line traces).
Page 13 of 37