Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
This rule detects the installation and execution of the PsExec service (PSEXESVC) on Windows systems. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation event. The rule then checks if the installed service's name is 'PSEXESVC' or if its image path ends with '\PSEXESVC.exe'. This is a common indicator of PsExec being used for remote execution.
Detects the installation of services that are characteristic of Metasploit's SMB PsExec module (exploit/windows/smb/psexec) and Impacket's psexec.py. The rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName matches a pattern of '%systemroot%\<8_random_chars>.exe' and the ServiceName matches a pattern of 4, 8, or 16 alphabetic characters, while excluding the known legitimate 'PSEXESVC' service.
This rule detects the execution of well-known credential dumping tools by monitoring Windows Security Event ID 4697, which signifies a service creation event. The rule specifically looks for service filenames containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This indicates an adversary attempting to install and run a service that can extract credentials from the system.
Detects the installation of a well-known TAP driver service, specifically looking for the 'tap0901' service file name. This activity could indicate preparation for data exfiltration using tunneling techniques, as TAP drivers are often used by VPN software like OpenVPN to create virtual network interfaces.
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
Detects the installation and execution of the 'csexecsvc' service, which is associated with the CSExec tool. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and correlates it with the service name 'csexecsvc' or an image path ending with '\csexecsvc.exe'.
Detects the installation or execution of services associated with known hack tools or UAC bypass techniques. The rule specifically looks for Windows Service Control Manager events (7045 for service installation, 7036 for service state changes) in conjunction with service names or image paths that are indicative of tools like cachedump, gsecdump, pwdump, PsExec, or UAC bypass mechanisms.
This rule detects the installation of an Exchange Transport Agent. Transport agents are .NET assemblies that can operate on email messages passing through the Exchange transport pipeline. Adversaries may abuse this functionality to establish persistence, intercept emails, or exfiltrate data.
This rule detects the installation of packet capture (pcap) drivers on Windows systems by monitoring Event ID 4697 (A service was installed in the system). The detection logic specifically looks for common filenames associated with pcap drivers such as 'pcap', 'npcap', 'npf', 'nm3', 'ndiscap', 'nmnt', 'windivert', 'USBPcap', and 'pktmon' within the ServiceFileName field. The installation of such drivers can indicate an adversary's attempt to perform network sniffing.
Detects the installation of the 'RTCore64' service, which is associated with Micro-Star MSI Afterburner. This service can be abused by attackers to load vulnerable drivers, a technique often referred to as 'Bring Your Own Vulnerable Driver' (BYOVD) for privilege escalation or defense evasion.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Detects the installation of the Azure Hybrid Connection Manager service by monitoring registry modifications. This service can be used to allow remote code execution from Azure functions, potentially as a method for adversaries to establish persistence or facilitate further access.
Identifies when a service principal is created in Azure. This activity can be an indicator of an adversary establishing persistence or preparing for further actions within the Azure environment.
This rule detects the installation of the 'HybridConnectionManager' service on a Windows system. This service is part of Azure Hybrid Connection Manager, which allows Azure services to connect to on-premises resources. While legitimate, its installation could also be leveraged by an attacker to establish persistence or facilitate data exfiltration from an compromised environment to Azure resources.
Detects the installation of a service by the smbexec.py tool, identified by a specific service name ('BTOBTO') and characteristic command-line arguments in the ImagePath, which typically involve executing a batch script and redirecting output.
Detects the creation of a service named 'ZzNetSvc' which is associated with the Moriya rootkit, as described in the 'Operation TunnelSnake' report by Securelist. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation.
Detects the installation of the NetSupport Manager client service on a Windows system. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service paths containing '\NetSupport Manager\client32.exe' or a service name of 'Client32'. This activity can be indicative of legitimate remote administration tool deployment or malicious use for persistence.
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
This rule detects the creation of a new Windows service where the service executable path contains 'powershell' or 'pwsh'. This behavior is often indicative of an adversary attempting to establish persistence or elevate privileges by running PowerShell scripts as a service.
Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.
Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.
Page 34 of 37