Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
Detects remote creation or modification of system processes for persistence
Detects exploitation of weak service registry ACLs for privilege persistence
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
This rule detects attempts to remotely create or modify services on a target system via SMB, specifically looking for the 'CreateService' string within TCP traffic on port 445. It thresholds on 3 occurrences from the same source within 60 seconds to reduce false positives.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the creation of a new Windows service (EventID 7045) where the service executable path contains both 'System32' and 'svchost', and the service description is either empty or contains 'Network'. This combination of characteristics can indicate the installation of a malicious service, potentially a backdoor or trojan, attempting to masquerade as a legitimate system service.
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
Detects execution and persistence mechanisms associated with the
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
MicrosoftSystem64 payload observed in malicious npm supply-chain
campaigns. The rule focuses on stable post-compromise artifacts
including execution, scheduled tasks, services, registry Run keys,
and startup folder persistence.
This rule detects the remote installation of a new Windows service over SMB (Server Message Block) protocol. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "CreateService" and "svcctl" (case-insensitive). This combination indicates an attempt to create a new service remotely, which can be a method for persistence or privilege escalation by attackers.
This rule detects attempts to register a new system service via a remote SSH connection. It specifically looks for the string "service install" within TCP traffic on port 22 (SSH) flowing from a client to a server within the home network. This activity could indicate an attacker establishing persistence on a compromised system.
Detects the creation or configuration of a Windows service using 'sc.exe' executed via 'cmd.exe', specifically looking for commands containing 'create' or 'config' along with 'binpath'. This activity can indicate persistence mechanisms or privilege escalation attempts by adversaries.
This rule detects the creation of a new Windows service (EventID 7045) where the service executable path contains both 'System32' and 'svchost', and the service description is either empty or contains 'Network'. This combination of characteristics can indicate the installation of a malicious service, potentially a backdoor or trojan, attempting to masquerade as a legitimate system service.
Detects the installation of the "MANC" service, which is used as a watchdog persistence mechanism for the ClientSetup payload in the TAX#TRIDENT campaign. This rule specifically looks for service installation events where the service name is "MANC".
Detects the creation of the 'CacheDB' service or specific 'Everything' registry run keys, which are persistence mechanisms utilized by the httpMalice backdoor (a Kimsuky PebbleDash variant).
Detects the installation and execution of DWAgent (dwagsvc.exe) from the C:\ProgramData directory, specifically looking for service installation and startup commands. Threat actors like Kimsuky are known to use legitimate RMM tools like DWAgent to maintain persistent remote access while blending in with normal administrative activities.
Phantom Bot Systemd Service Persistence
Cortex XDR
Detects Linux persistence mechanisms specifically associated with the creation or execution of the 'phantom-bot.service' systemd service, used by the axois-utils phantom bot to execute DDoS attacks. The rule looks for process creation events on Linux where the command line contains 'phantom-bot.service' and the process name is 'sh', 'bash', 'systemctl', or 'node'.
Page 25 of 37