Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects the WinGet DSC configuration engine spawning service management processes such as sc.exe or PowerShell to create or modify Windows services. This activity is consistent with the abuse of DSC 'Service' resources to achieve persistence or privilege escalation by registering services to run as LocalSystem.
Detects lateral movement activities involving the use of PsExec-style tools or the manual creation of remote services to execute commands. This behavior often leverages SMB admin shares (ADMIN$, C$) to drop and execute binaries or scripts, a technique frequently observed in ransomware campaigns and red team engagements.
Detects the creation of a new Windows service (EventID 7045) where the binary path references the ADMIN$ share, contains known remote execution tool artifacts (e.g., PSEXESVC, PAExec), or uses a randomized/GUID-like naming convention. This pattern is indicative of classic SMB-based lateral movement where an adversary performs remote code execution via service installation following credential compromise.
Detects potential persistence and network persistence mechanisms associated with the MSP360 RMM agent. The rule correlates the creation of a Windows service for RMM.Agent.exe or RMM.Agent.Launcher.exe with the addition of a firewall rule allowing UDP traffic on port 48678 by netsh or PowerShell, occurring within a one-hour window.
Detects potential persistence and network persistence mechanisms associated with the MSP360 RMM agent. The rule correlates the creation of a Windows service for RMM.Agent.exe or RMM.Agent.Launcher.exe with the addition of a firewall rule allowing UDP traffic on port 48678 by netsh or PowerShell, occurring within a one-hour window.
Detects the creation of new Windows services using sc.exe or PowerShell where the binary path is located in common user-writable or temporary directories (e.g., Temp, AppData, ProgramData), or where the service name mimics legitimate Windows system services, a technique often used for persistence or lateral movement (e.g., PsExec).
This rule detects the creation of services or execution of processes associated with remote management tools like PsExec or PAExec. It looks for common service names (PSEXESVC, PAExec), suspicious executable paths in temporary directories (e.g., \Temp\, \AppData\Local\Temp\), or command-line patterns indicating remote execution via ADMIN$ shares. These indicators are frequently used by adversaries for lateral movement and remote command execution.
Detects suspicious post-exploitation activities, including service creation, local account modification, or security tool tampering, executed as SYSTEM shortly after activity associated with the ADSelfService Plus GINA logon-screen vulnerability (CVE-2026-74849).
Detects lateral movement via SMB by identifying multiple connections to Windows admin shares (ADMIN$ or C$) followed within a 10-minute window by the creation of a remote service, often indicative of techniques like PsExec. This pattern detects suspicious fan-out behavior where a single source host interacts with multiple targets.
Detects the loading or service registration of known vulnerable or malicious signed drivers commonly used in Bring Your Own Vulnerable Driver (BYOVD) attacks. These drivers are leveraged by adversaries to gain kernel-level privileges, bypass security controls, and terminate endpoint protection agents.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects the installation and execution of Cloudflare Tunnel (cloudflared.exe) as a Windows service. Adversaries may abuse this utility to create unauthorized persistent network tunnels, enabling covert remote access to the internal network. This rule correlates process creation events involving 'service install' or 'tunnel run' commands with Windows service installation events referencing the cloudflared binary.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects the creation of a Windows service that points to a .sys file located in common temporary directories (Temp, Windows\Temp). This behavior is characteristic of adversaries attempting to load malicious kernel drivers, often for persistence or privilege escalation, such as in Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects an accelerated sequence of attack phases—specifically recon, privilege escalation, lateral movement, and persistence—occurring on a single device within a short timeframe (15 minutes). This behavioral pattern indicates potential automated or script-orchestrated intrusion activity.
Detects the installation of a new Windows service where the executable path is located in suspicious or uncommon directories (e.g., Temp, Users, AppData) or uses known living-off-the-land binaries (LotLBin) in the command path. This pattern is commonly used by adversaries for persistence and privilege escalation.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Page 4 of 37