Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Windows Pcap Drivers
Sigma
Detects Windows Pcap driver installation based on a list of associated .sys files.
Detects the installation of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools for persistence, privilege escalation, and remote control of compromised systems.
Detects known malicious service installations associated with Cobalt Strike beacons, often used for privilege escalation or lateral movement. The rule specifically looks for patterns in the ServiceFileName field of Windows Security Event ID 4697, such as the presence of 'ADMIN$' and '.exe', '%COMSPEC%', 'start', and 'powershell', or encoded PowerShell commands often used by Cobalt Strike.
Detects the installation of a PDQDeploy service on a target system. When a package is deployed via PDQDeploy, it installs a remote service named "PDQDeployRunner-X" (where X is an integer) on the target machine.
Detects the installation of a Windows service by the Sliver C2 framework. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, combined with an ImagePath characteristic of Sliver (an executable in the Windows temporary directory with a 10-character alphanumeric name) or a ServiceName explicitly identifying as 'Sliver' or 'Sliver implant'. This behavior is often observed when Sliver implants use tools like PsExec to establish persistence.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\". Attackers often use such directories for staging purposes. This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation. Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.
This rule detects the installation of a new service that exhibits characteristics commonly associated with the Meterpreter or Cobalt Strike 'getsystem' command. Specifically, it looks for Event ID 4697 (A service was installed in the system) and then analyzes the 'ServiceFileName' for patterns indicative of these tools. It identifies two main techniques: one involving 'cmd.exe' or '%COMSPEC%' echoing data to a named pipe (e.g., `echo 559891bb017 > \\.\pipe\5e120a`), and another involving 'rundll32.exe' loading a DLL with specific arguments (e.g., `rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn`). Additionally, it flags service installations where the 'ServiceFileName' starts with a specific network share path (`\\127.0.0.1\ADMIN$\`). These methods are typically used by adversaries to escalate privileges to SYSTEM.
Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
Detects the creation of a new Windows service where the client process or its parent process has a Process ID (PID) of 0. A PID of 0 typically indicates the System Idle Process, which should not be initiating service installations. This behavior can be indicative of highly privileged malware or rootkits attempting to establish persistence or escalate privileges by creating services in an unusual context.
This rule detects the creation of new systemd service unit files in standard systemd directories. Adversaries often create or modify systemd services to establish persistence or escalate privileges by executing malicious code at system startup or when specific events occur. The rule specifically looks for file creation events in '/usr/lib/systemd/system/', '/etc/systemd/system/', and user-specific '/.config/systemd/user/' directories, which are common locations for systemd unit files.
Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
Detects the installation of a PDQDeploy service on a machine. PDQDeploy is a legitimate system management tool that can be leveraged by attackers to remotely install packages or execute commands on target machines, leading to persistence or privilege escalation.
Detects the creation of a new Windows service where the creating process has a Process ID (PID) of 0 or its parent process has a PID of 0. This is an unusual and suspicious behavior, as PID 0 is typically reserved for the System Idle Process or the System process itself, which should not be directly creating services. This could indicate a highly privileged process or kernel-level activity attempting to establish persistence or escalate privileges.
Detects the creation of new Windows services that exhibit characteristics commonly associated with Cobalt Strike beacon activity, specifically focusing on suspicious ImagePath values. This includes services created with paths pointing to ADMIN$ shares, PowerShell commands for execution, or encoded PowerShell commands often used for downloading and executing payloads.
Detects the installation of a new service by Meterpreter or Cobalt Strike's 'getsystem' command. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, combined with command-line patterns indicative of Meterpreter/Cobalt Strike's techniques for privilege escalation, such as using 'echo' to a named pipe, 'rundll32' with specific arguments, or creating a service from a local administrative share.
This rule detects the installation or start of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools to maintain persistence, escalate privileges, or establish command and control over compromised systems. The rule specifically looks for Event IDs 7045 (Service Installation) and 7036 (Service Started) from the 'Service Control Manager' provider, where the service name contains keywords indicative of known remote access software such as AmmyyAdmin, TeamViewer, LogMeIn, and others.
Detects the creation of a Windows service named 'KrbSCM' which is associated with the KrbRelayUp tool. This tool is used for privilege escalation in Windows domain environments where LDAP signing is not enforced, leveraging Kerberos relay attacks.
This rule detects the creation of specific Windows services ('srservice', 'ipvpn', 'hkmsvc') that have been identified as malicious by ESET in their 'Carbon Paper - Turla' report. These services are associated with the Turla APT group's second-stage backdoor, indicating potential privilege escalation and persistence mechanisms.
Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.
Page 29 of 37