Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects the creation or modification of a Windows service named 'BluetoothService' where its executable path points to a non-standard, user-writable location (e.g., AppData, Temp, ProgramData). This technique is often used by malware, such as the Chrysalis backdoor in the Lotus Blossom campaign, to establish persistence and evade detection by masquerading as a legitimate system service.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Detects the creation of a Windows service followed by the use of "sc.exe sdset" to apply a highly restrictive security descriptor. This specific TTP is used by the REF4033 group (UAT-8099) to harden their malicious 'WalletServiceInfo' service, making it difficult for administrators to stop or delete.
This rule detects the deployment and potential abuse of Velociraptor, a DFIR (Digital Forensics and Incident Response) tool. It identifies Velociraptor by monitoring file creation/modification in common installation paths and for its executable name, process execution, and the creation of suspicious child processes (like PowerShell, cmd, curl, wget) by Velociraptor. The rule also attempts to correlate these activities to determine the severity of the detection, indicating potential post-exploitation activity.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
This rule detects the creation of the PsExec service (PSEXESVC, psexesvc, svcsvc, spoolsrv) or the execution of psexec.exe. PsExec is a legitimate Microsoft tool that allows administrators to execute processes on remote systems, but it is frequently abused by attackers for lateral movement and remote execution.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
Detects the installation of the "Hotta Killer" tool, a Bring-Your-Own-Vulnerable-Driver (BYOVD) process killer used by the Interlock ransomware group to terminate security software. This is identified by the creation of a specific kernel driver file (`UpdateCheckerX64.sys`) and a corresponding Windows service with a distinct naming pattern (`UpdateCheckerX64_{random-numbers}`).
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the installation or loading of the POORTRY (Abyssworker) driver, a vulnerable driver used by Osiris ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software. This rule identifies the driver by its file name, service name, known hashes, and a masquerading technique where it pretends to be a Malwarebytes component.
Detects the creation or modification of a Windows service to belong to a high-priority service group.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (A service was installed in the system). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
Detects the creation of a Windows service named "NSecRTS" with the display name "Windows Real-time Protection Service" and an executable path in a suspicious "NSEC" folder. This behavior is associated with a China-linked RAT observed in an Indian Income Tax-themed phishing campaign.
Detects the creation of systemd services used by the PCPcat malware for persistence on Linux systems.
This rule detects the creation of new Windows services where the executable path is suspicious. Suspicious paths include common temporary or user-writable directories like `Users\Public`, `ProgramData`, `AppData`, or `Windows\Temp`. Additionally, it flags services that directly execute `cmd.exe` or `powershell.exe` with suspicious arguments (e.g., encoded commands, hidden windows, or `/c` for command execution), or `rundll32.exe` from suspicious paths. It also identifies services with very short, alphanumeric names, which could indicate an attempt at masquerading.
Detects the creation of a Windows service with a suspicious name or an executable path in an unusual location, a technique used by APT41 for persistence.
Detects the installation of the Velociraptor agent as a Windows service, a technique used by threat actors for persistence and command and control (C2).
Detects a creation of systemd services which could be used by adversaries to execute malicious code.
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
Page 28 of 37