Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects evidence of the TELEPUZ malware establishing persistence by installing a Windows service named 'CipherAllocator' or 'PilotmasterMast'. The rule monitors for the installation of these specific services via Windows Event ID 7045, process command line execution, and direct registry key modifications.
This rule detects various common methods of achieving persistence on Linux and macOS systems. It monitors file system changes to systemd unit files and macOS LaunchAgent plist files, as well as the execution of commands related to managing systemd services and user crontab entries.
Detects the installation of the srt64.sys kernel driver, associated with the Daxin rootkit. The detection monitors for the creation of this specific file within the System32\drivers directory and the creation of services referencing the driver file.
Detects the execution of the PsExec service (psexesvc.exe) which is commonly used for remote command execution and lateral movement. This rule monitors for process creation events where psexesvc.exe is spawned by services.exe or wininit.exe, indicative of a remote service installation typically associated with administrative or adversary activity.
Detects the creation of a new Windows service where the service binPath points to 'anydesk.exe', optionally accompanied by a system reboot command within one hour of the service creation. This behavior is often associated with the installation or persistent configuration of remote access software.
This rule detects the registration of the 'CipherAllocator' Windows service associated with the TELEPUZ malware. It monitors registry modifications related to service creation, specifically identifying the usage of 'grpeng.dll' from a suspicious path ('C:\ProgramData\XeroxPrint\Temp\Worker\') and specific 'svchost' registry configurations used for persistence.
Detects the creation or modification of a Windows service named 'ThumbcacheService', which has been associated with the GoSerpent campaign for file collection. The rule monitors both registry modifications indicative of service installation and process execution patterns using sc.exe, reg.exe, powershell.exe, or cmd.exe that reference this specific service name.
This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Detects a process that simultaneously loads 'RstrtMgr.dll' and modifies the 'WaitToKillServiceTimeout' registry value within a 2-minute window. This behavior is indicative of an adversary attempting to force system service restarts or accelerate service termination, often seen as part of persistence mechanisms or defensive impairment.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detects the creation of a Windows service associated with the AnyDesk remote access application using the sc.exe utility. This behavior often indicates the unauthorized installation or persistence setup of a remote access tool.
Detects the creation or starting of an AnyDesk service using command-line arguments to specify custom configuration directories or service names. This pattern is often used by adversaries to establish persistence or ensure remote access tools are configured with specific, potentially silent or pre-defined, settings.
Detects the installation and service creation of the Nezha agent, a monitoring tool often abused by threat actors to establish persistent backdoors on compromised systems.
This rule detects the creation of a Windows service named 'SecurityHealthIron' using the sc.exe utility or direct service creation calls. This specific naming convention is often associated with suspicious or potentially malicious activity attempting to masquerade as a legitimate Windows Security Health service.
Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.
Detects the Snowlight dropper (UNC5221) installing a new Windows service named 'Windows Update Service' that utilizes a non-standard executable file named 'wusvc.exe' to achieve persistence and masquerade as the legitimate Windows Update service (wuauserv).
Detects the creation of a Windows service named 'wsftprm'. This specific service name is often associated with malicious activities, particularly in historical cases involving persistent threats or unauthorized software installation.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
Page 14 of 37