Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
This rule identifies potential persistence activity on a Windows host by correlating multiple indicators such as service creation, scheduled tasks, registry run key modifications, Winlogon helper modifications, and driver loading. It specifically monitors for indicators associated with 'NetSupport' or 'client32' filenames or services. The rule triggers when two or more distinct persistence mechanisms are detected for the same host and user.
Detects indicators of the SparroWocky Trident loader, including specific side-loaded DLLs (winfsp-x64.dll, DukeQt.dll), encrypted payload files with custom magic headers, persistence mechanisms such as specific service names and registry keys, inter-process communication objects (mutexes, events, shared memory), and named pipes used for C2 communication.
This rule detects the creation of new Windows services (Event IDs 7045 and 4697) where the service binary path points to potentially suspicious locations such as user profiles, temp directories, program data, or common command interpreters. This pattern is frequently used by adversaries for persistence mechanisms or to deploy malicious drivers/tools.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
This rule detects potentially malicious activity related to the installation or misconfiguration of GitLab runner executables. It looks for unusual service creation, direct execution of runner binaries from temporary locations (e.g., C:\Windows\Temp), and the presence of configuration files or PowerShell scripts in unexpected directories that might indicate persistent access or unauthorized setup of a build runner.
Detects the installation of a GitLab Runner service on Windows, specifically identifying cases where the service is configured to run under the LocalSystem account. This is monitored via Service Control Manager (Event ID 7045), Sysmon (Registry Event ID 13), and process creation events involving sc.exe or gitlab-runner.exe.
This rule detects activities related to the loading or registration of the 'NvFsFilter' driver (nvfsflt64.sys). It monitors for command-line attempts to interact with services (using sc.exe, reg.exe, or services.exe), registry modifications involving the NvFsFilter service, and the actual loading of the nvfsflt64.sys file. This is intended to identify potential persistence mechanisms or the deployment of potentially unauthorized or malicious drivers.
This rule detects the installation of a new Windows service (Event ID 7045 or 4697) with an 'auto start' configuration that is immediately followed by the termination of multiple processes (either 'services.exe' or the service's own image file) within a 60-minute window on the same host. This pattern can indicate an unstable or malicious service deployment that causes system instability or performs rapid cleanup.
Detects the loading or installation of specific NVIDIA file system filter drivers ('Alinubx.sys', 'CcProtect.sys', 'nvfsflt64.sys') or services related to the 'NvFsFilter'. These drivers are associated with NVIDIA driver components; however, they can be targeted for unauthorized usage or mimicry.
Detects the installation of Windows services with image paths containing strings associated with known commodity malware or potentially unwanted software (Alinubx, CcProtect, nvfsflt64, NvFsFilter). This activity is often indicative of persistence mechanisms or driver-based malicious components being registered on the host.
Detects anomalous post-exploitation behaviors such as mass file modifications, lateral movement (SMB/RDP), or persistence mechanisms (scheduled tasks/services) following ScreenConnect client session activity. This behavior is indicative of potential exploitation of ScreenConnect to deploy ransomware or move laterally within the network.
Detects signs of NetSupport Manager (client32.exe) establishing multiple persistence mechanisms simultaneously or in quick succession, including Windows service creation, Winlogon helper registration, Registry Run key modification, scheduled task creation, and keyboard filter driver installation. This behavior is indicative of unauthorized use of remote access tools to maintain persistence on a host.
Detects the creation or modification of a Windows service named 'ProcAuditManager' via registry keys or command-line utilities. This pattern is indicative of potential persistence mechanisms or service manipulation for malicious purposes.
Detects the creation or modification of a Windows service named 'ProcAuditManager' via registry keys or command-line utilities. This pattern is indicative of potential persistence mechanisms or service manipulation for malicious purposes.
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
This rule detects the presence, installation, or execution attempts of the known vulnerable GIGABYTE driver (gdrv.sys). Monitoring for this specific driver is a common practice to identify attempts to perform 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, which can be used for kernel-mode code execution and privilege escalation.
Detects the creation of Windows services using 'sc.exe' with command line arguments containing 'cplsupport' or 'wtas'. These specific strings are associated with persistence mechanisms used by the MQTTDoor and MatrixDoor backdoors.
Detects the use of sc.exe or cplsupport.exe with command-line arguments often associated with service installation, configuration, or modification. This behavior may indicate an adversary attempting to establish persistence or escalate privileges by creating or modifying Windows services.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Page 7 of 37