Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
31
7
6
6
4
Contributors
21
10
8
5
4
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
52
2
2
2
1
Products / Services
20
16
15
9
8
MITRE Techniques
30
30
23
23
21
This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.
The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.
Detects when the same initiating process stops or deletes Windows services and subsequently deletes scheduled tasks or WMI event subscriptions within a 15-minute window on a single device, potentially indicating defense evasion or clean-up actions.
Detects a service principal or application identity performing a burst of deletion operations across multiple Azure resource types, such as Storage Accounts, SQL Databases, Key Vaults, and Function Apps. This behavior is indicative of malicious activity, including potential cloud environment destruction or 'agentic' destructive operations similar to those observed in the Storm-3168 (JADEPUFFER) threat activity.
Detects the creation of suspicious Windows services associated with remote execution tools like PsExec, PAExec, or custom tools that leverage SMB administrative shares (ADMIN$, IPC$). The rule correlates the service creation event (Event ID 7045, 4697) with preceding network connection attempts to SMB shares, and subsequent service termination or state change events within a short timeframe, which is a pattern characteristic of remote lateral movement and command execution.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects modifications to AWS Lambda functions that indicate potential backdooring, specifically unauthorized resource policy grants (lambda:InvokeFunction with a wildcard principal) or unexpected function code/configuration updates. This activity enables persistent, low-visibility execution by leveraging existing function permissions.
Detects attempts to terminate or delete security-related services and logging agents, such as Sysmon, Filebeat, and various endpoint protection agents, using legitimate Windows system utilities like taskkill, sc, or wmic.
Detects the execution of BTR_CLI.exe with cleanup parameters that correlate with the deletion of specific registry keys (services) and related file artifacts (e.g., .dat or changelist files) within a short time window. This pattern is indicative of a post-compromise cleanup routine aimed at removing traces of malicious services or payloads.
Detects evidence of anti-forensic activities associated with the SparroWocky toolset. The rule monitors for the removal of the 'ProcAuditManager' service, deletion of the 'SnapCart' registry key, and the execution of a self-deleting batch script used to remove forensic artifacts.
Remote Service Creation via SVCCTL RPC
Cortex XDR
Detects remote service manipulation, including service creation, starting, and deletion, using the SVCCTL RPC interface. This activity is a common method for lateral movement and remote code execution by tools like PsExec, smbexec, and CrackMapExec.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
Detects a malicious teardown sequence involving the 'drvsvc' service being stopped or deleted in the registry, followed by the deletion of the 'C:\Windows\System32\drivers\drv.sys' file within a 15-minute window. This behavior is indicative of a driver redeployment process, often associated with the removal of security-disabling components.
Page 1 of 3