Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
68
33
18
16
13
Contributors
35
33
27
19
11
Categories
20,396
11,792
5,863
5,144
4,864
Platforms
139
40
6
4
2
Products / Services
48
36
29
25
20
MITRE Techniques
119
91
80
77
46
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects the WinGet DSC configuration engine spawning service management processes such as sc.exe or PowerShell to create or modify Windows services. This activity is consistent with the abuse of DSC 'Service' resources to achieve persistence or privilege escalation by registering services to run as LocalSystem.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
Detects evidence of persistence mechanisms targeting Docker environments on Linux systems. The rule identifies suspicious modifications using crontab, systemctl (service creation/start), and chattr (to make files immutable), specifically monitoring for artifacts related to '.docker-network-monitor' and 'docker-network-resolver'. It flags systems where multiple such configuration changes occur within a single day.
Detects a sequence of suspicious process executions related to the 'RemoteAgent' application, specifically monitoring for MSI-based installations, NSSM service management, and API checks across a device. The rule aggregates distinct process events per device and flags if two or more distinct indicators are identified within a 14-day window.
Detects the registration of the 'gitlab-runner' Windows Event Log provider on hosts that are not recognized as legitimate CI/CD build servers. This can indicate unauthorized installation of GitLab runner agents or persistence mechanisms leveraging service-related event logging.
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects a specific concealment behavior attributed to the 'com.corp.mdm' Android implant. The rule monitors for a sequence of events where the application disables its own launcher (main activity) to hide from the app drawer, immediately followed by the initiation of a foreground service that masquerades as a system notification ('Android System' title with 'System service running.' text).
Detects the creation or start of the PSEXESVC service, which is a characteristic behavior of the PsExec tool used for remote execution and lateral movement.
Detects a sequence of suspicious process executions related to the 'RemoteAgent' application, specifically monitoring for MSI-based installations, NSSM service management, and API checks across a device. The rule aggregates distinct process events per device and flags if two or more distinct indicators are identified within a 14-day window.
Detects the loading or installation of specific NVIDIA file system filter drivers ('Alinubx.sys', 'CcProtect.sys', 'nvfsflt64.sys') or services related to the 'NvFsFilter'. These drivers are associated with NVIDIA driver components; however, they can be targeted for unauthorized usage or mimicry.
Remote Service Creation via SVCCTL RPC
Cortex XDR
Detects remote service manipulation, including service creation, starting, and deletion, using the SVCCTL RPC interface. This activity is a common method for lateral movement and remote code execution by tools like PsExec, smbexec, and CrackMapExec.
Detects the loading or presence of the vulnerable GIGABYTE driver (gdrv.sys), which is frequently exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level access and disable security products. The rule monitors for file artifacts and service creation/execution commands associated with this driver.
Detects when the Postgres service process or account attempts to modify system-level persistence mechanisms, such as scheduled tasks (cron/schtasks) or system services (systemd/startup folders), which are typical behaviors for an adversary using database service context to maintain persistence.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Page 2 of 9