Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects the installation of the OpenSSH Server feature or the creation of an 'sshd' service on Windows workstations. Adversaries may install OpenSSH as a persistent, covert backdoor to maintain access to a compromised host.
Detects the creation of new services or modification of service configurations using command-line tools (sc.exe, PowerShell) spawned by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. This activity is indicative of potential privilege escalation or persistence mechanisms being established under the context of legitimate Windows components.
Detects the creation of Windows services or modification of service configurations triggered by WinGet DSC-related processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This pattern is often associated with the DSCourier persistence technique, where adversaries leverage the Desired State Configuration (DSC) framework to maintain a presence on a compromised host.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Detects the creation or modification of files within /etc/systemd/system/ or /etc/init.d/ by non-standard management processes. Attackers often use these paths to establish persistence by creating or altering service unit files to execute malicious code automatically upon system boot or service restart. The rule specifically excludes common system management tools.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
Detects suspicious service-based persistence activity associated with JFMBackdoor, specifically when fltMC.exe (a known host process) initiates child processes sc.exe or services.exe to create or start a service, using file paths located in C:\ProgramData\Microsoft\Network and specific registry key modification patterns.
Detects the creation or modification of Windows services using sc.exe or PowerShell New-Service where the binary path points to suspicious user-writable directories such as Temp or AppData, a technique observed in the Red Lamassu JFMBackdoor infection chain.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
This rule detects various activities associated with the RustDesk remote access tool, including process execution, file staging (RustCustom.zip or rustdesk.exe by hash), firewall rule creation for RustDesk, and service installation related to RustDesk. Detection is based on process names, file names, SHA256 hashes, firewall rule names, and service names.
This rule detects the use of sc.exe to create or interact with Windows services related to 'Mixed Reality' components, such as 'MixedSvc' or 'Windows Mixed Reality Service'. This activity is often associated with the installation of persistence mechanisms or service-based execution by masquerading as legitimate Windows components.
Detects the creation of a Windows service named 'MixedSvc' that points to the suspicious path 'C:\Program Files\Windows Media Player\Mixed Reality.exe'. This behavior is associated with DcRAT's Operation DragonReturn, where the malware attempts to establish persistence on the host by masquerading as a Windows Media Player component.
Detects the creation of a Windows service named 'MixedSvc' or services with lure-themed display names (e.g., related to 'Windows Mixed Reality') executing binaries from suspicious, user-writable directories. This pattern is consistent with the DcRAT persistence mechanism observed in the Operation DragonReturn espionage campaign.
Detects the creation or modification of a Windows service configured for automatic startup under the LocalSystem account that references the GitLab Runner executable. This pattern is commonly used for persistence via CI/CD runner abuse, including threats like the Shai-Hulud worm.
Detects the creation or modification of services associated with PsExec, a legitimate tool often abused by adversaries for remote execution. The rule looks for specific service names or file paths indicative of PsExec activity, including the default 'PSEXESVC' service name, or file paths containing 'ADMIN$' or 'IPC$' shares, or a randomly named executable in the SystemRoot directory. It filters out activity from designated administrative workstations and common system accounts.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
This rule detects the loading or execution of known vulnerable kernel drivers. These drivers are often leveraged by adversaries in Bring Your Own Vulnerable Driver (BYOVD) attacks to achieve privilege escalation by exploiting vulnerabilities in the driver to execute code in kernel mode.
Detects the creation of a Windows service using administrative tools (sc.exe or net.exe) followed closely by an instruction to start that service within a 5-minute window. This behavior is often associated with the execution of malicious payloads or lateral movement.
Page 21 of 37