Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects creation of new Windows services for persistence
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects the creation of a persistent Windows service using 'sc.exe' that masquerades as 'OneDriveServers' to potentially run ScreenConnect, as observed in Operation SilentCanvas. This rule specifically looks for the 'sc.exe' utility being used with 'create' and 'OneDriveServers' in its command line arguments.
Targets service registration for msidiskserver or an ImagePath ending in fsdiskbit.sys. The UDM rule retains principal and target context for correlation.
This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.
Detects deceptive registration using the exact string 'Microsoft Update Service' mapped to non-Microsoft binaries in non-standard paths. This could indicate an adversary attempting to masquerade malicious activity as legitimate system services.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Correlates the creation of arbitrary new Windows services via sc.exe with immediate subsequent execution of binaries located in Public or ProgramData directories. This behavior is indicative of an attacker establishing persistence on a system by creating a malicious service that executes from a common writable location.
Detects the creation or modification of the CadenceOptimizer service registry keys, indicating Vidar Turb00 persistence via a dropped secondary payload. This rule specifically looks for registry events affecting the 'CadenceOptimizer' service path.
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.
Detects replacement of service binaries for execution flow hijacking
Detects creation of new Windows services for persistence
Detects references to the misspelled service 'MicrosoftUpdateSerice' during service creation or manipulation within process command lines. This specific misspelling has been associated with the MuddyWater APT group.
Detects commands enabling the malicious update-monitor or gh-token-monitor systemd services to start automatically on system boot.
Detects creation of malicious container services via Docker API for persistence
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
Detects abuse of macOS XPC services for inter-process execution
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
This rule detects the string "systemctl enable" within TCP traffic on port 22 (SSH). This indicates an attempt to enable a systemd service on a remote Linux host via an established SSH connection. This activity could be part of legitimate system administration but also could be indicative of an attacker persisting a malicious service.
Page 24 of 37