Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
Detects the installation and execution of the RemCom service, which is often used for remote administration and can be leveraged by adversaries for lateral movement or persistence.
Detects the installation of a new Windows service where the service executable's image path contains suspicious locations such as 'AppData' directories or remote IP addresses like '127.0.0.1' or 'localhost'. This can indicate an attempt at persistence or privilege escalation by adversaries installing malicious services in non-standard locations.
Detects the creation of new Windows services with specific names ('Name', 'msupdate', 'msupdate2') and an ImagePath containing '\Windows\System32\svchost.exe'. This pattern is associated with the COLDSTEEL RAT for persistence.
Detects obfuscated PowerShell commands used in service creation events, specifically looking for patterns indicative of Invoke-Obfuscation's VAR++ LAUNCHER technique. The rule identifies service creations where the ImagePath contains specific keywords like '&&set', 'cmd', '/c', '-f', and format specifiers like '{0}', '{1}', etc., which are characteristic of highly obfuscated PowerShell commands often used for defense evasion.
Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.
Detects the installation of a service by PAExec, a remote administration tool. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service names or image paths starting with 'PAExec-'. This is a common indicator of PAExec being used to execute commands or deploy tools remotely.
This rule detects the installation of the 'Remote Utilities - Host' service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation. The detection is further refined by checking for the presence of 'rutserv.exe' and '-service' in the ImagePath, or the exact service name 'Remote Utilities - Host'. This activity is often associated with remote access tools, which can be used legitimately for IT administration but also by adversaries for persistence and remote control.
This rule detects the installation of a TAP (Tunnel Adapter) driver, specifically looking for 'tap0901' in the service's ImagePath. TAP drivers are commonly used by VPN software like OpenVPN to create virtual network interfaces, which can be leveraged for tunneling and data exfiltration. The detection aims to identify potential preparation for data exfiltration using tunneling techniques.
This rule detects the creation of new Windows services with suspicious or uncommon image paths. It specifically looks for paths containing references to named pipes, common temporary directories like `Users\Public\` or `Windows\Temp\`, or image paths that include patterns indicative of encoded PowerShell commands (e.g., `-e` followed by specific base64 encoded strings). This behavior is often associated with adversaries establishing persistence or escalating privileges by creating malicious services.
Detects the installation of a new Windows service where the executable path contains suspicious patterns, specifically executables located directly under 'ProgramData' or the root of the C: drive with a short, potentially obfuscated name (e.g., 'C:\ProgramData\.{1,9}\.exe' or 'C:\.{1,9}\.exe'). This pattern is often used by malware for persistence and to evade detection by hiding in less common locations.
This rule detects the creation of a new Windows service (EventID 4697) where the service's file name contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS OBFUSCATION technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either 'system.io.compression.deflatestream' or 'system.io.streamreader'. This combination suggests an attempt to decompress and execute obfuscated PowerShell code.
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the 'ImagePath' contains patterns indicative of obfuscated PowerShell execution via standard input (stdin). Specifically, it looks for the presence of 'set' and '&&' along with keywords like 'environment', 'invoke', or 'input' within the service's executable path, suggesting an attempt to execute obfuscated commands.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Detects the creation of a Windows service named "WerFaultSvc" with a specific ImagePath pattern, which has been identified as a persistence mechanism used by the SNAKE malware (also known as EKANS) as described in CISA reports. The rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, where the service name contains 'WerFaultSvc' and the ImagePath starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe'.
This rule detects the creation of a new Windows service where the ImagePath contains 'rundll32.exe', 'shell32.dll', 'shellexec_rundll', and 'powershell'. This specific combination is indicative of an attempt to execute obfuscated PowerShell code via rundll32.exe, a common technique for defense evasion and execution.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
Detects the creation of a new service where the ImagePath contains 'rundll32' and 'shell32.dll' along with obfuscation indicators like '&&', 'value', 'invoke', 'comspec', or 'iex'. This pattern is often used by adversaries to execute obfuscated PowerShell commands via rundll32, specifically leveraging 'shellexec_rundll'.
This rule detects the use of the `sc.exe` utility to modify the security descriptor of a Windows service. Specifically, it looks for the `sdset` command-line argument, which can be used to grant special permissions to a service, potentially allowing it to be hidden or manipulated for persistence and defense evasion. This technique can be used by adversaries to maintain access and avoid detection by making services less visible to standard enumeration tools.
Page 35 of 37