Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
68
33
18
16
13
Contributors
35
33
27
19
11
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
139
40
6
4
2
Products / Services
48
36
29
25
20
MITRE Techniques
119
91
80
77
46
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
Detects suspicious modifications to a Windows service's Discretionary Access Control List (DACL) using 'sc.exe' to deny access to critical trustees. This technique can be used by adversaries to hide services, make them unstoppable, or achieve persistence and privilege escalation by preventing legitimate users or administrators from managing the service.
Detects attempts to harvest credentials by enabling the RemoteRegistry service or dumping the SAM, SECURITY, or SYSTEM registry hives, which are behaviors associated with the Flax Typhoon APT group.
The analytic detects the creation or enabling of services on Linux platforms using the `systemctl` or `service` tools. It leverages Endpoint Detection and Response (EDR) logs, focusing on process names, parent processes, and command-line executions. This activity is significant as adversaries may create or modify services to maintain persistence or execute malicious payloads. If confirmed malicious, this behavior could lead to persistent access, data theft, ransomware deployment, or other damaging outcomes. Monitoring and investigating such activities are crucial for maintaining the security and integrity of the environment.
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
This analytic detects the execution of commands to start or enable services on Linux systems. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
Detects a sequence of events indicative of privilege escalation via TrustedInstaller token manipulation, a technique used by MostereRAT. The rule looks for a process starting the 'TrustedInstaller' service and then immediately launching a new process as the SYSTEM user.
Detects the PerfhLoader persistence technique used by the Lazarus Group, which involves modifying the 'SessionEnv' service to start automatically and either adding sensitive privileges or dropping a malicious DLL for phantom loading. This rule correlates events across process launches (sc.exe modifying SessionEnv service), registry modifications (adding privileges to SessionEnv service), and file creations (dropping a specific DLL for phantom loading).
This KQL query detects suspicious service activities (installation, modification, or deletion) by comparing events with a curated list of known suspicious Windows services. It extracts service names and accounts from device events and joins them with an external CSV list of suspicious services to identify matches. The query aims to alert on the presence or manipulation of services commonly associated with malicious activity.
The following analytic detects the creation or modification of Windows services using the sc.exe command. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because manipulating Windows services can be a method for attackers to establish persistence, escalate privileges, or execute arbitrary code. If confirmed malicious, this behavior could allow an attacker to maintain long-term access, disrupt services, or gain control over critical system functions, posing a severe threat to the environment.
The following analytic identifies the use of PowerShell's Start-Service or Stop-Service cmdlets on an endpoint. It leverages PowerShell Script Block Logging to detect these commands. This activity is significant because attackers can manipulate services to disable or stop critical functions, causing system instability or disrupting business operations. If confirmed malicious, this behavior could allow attackers to disable security services, evade detection, or disrupt essential services, leading to potential system downtime and compromised security.
The analytic detects the first occurrence of a Windows service running in the environment by leveraging Windows system event logs (EventCode 7036) to identify services entering the "running" state. The appearance of a new or previously unseen service could indicate the installation of unauthorized or malicious software, potentially allowing an attacker to execute arbitrary code, maintain persistence, or escalate privileges. Monitoring for new services aids in early detection of potential threats.
The analytic detects changes in a Windows service's security descriptor where a new deny access control entry (ACE) has been added. It specifically looks for executions of 'sc.exe' with the 'sdset' flag, targeting any service, and including a deny ACE. Such modifications can be used by attackers to escalate privileges, disable security services, or blind defenses by preventing legitimate users or services from interacting with the modified service.
The following analytic detects changes in a service security descriptor where a new deny ace has been added. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for any process execution involving the "sc.exe" binary with the "sdset" flag targeting any service and adding a dedicated deny ace. If confirmed malicious, this could allow an attacker to escalate their privileges, blind defenses and more.
This analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
This analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
The following analytic detects the execution of `sc.exe` with command-line arguments used to start a Windows Service on a remote endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because adversaries may exploit the Service Control Manager for lateral movement and remote code execution. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, potentially leading to further compromise and persistence within the network.
Detects scenarios where the OpenSSH server starts listening on an SSH socket, which could indicate an attacker enabling the service for remote access or persistence. This rule specifically looks for EventID 4 from the OpenSSH service with the process name 'sshd' and a payload starting with 'Server listening on '.
This rule detects the Hybrid Connection Manager service running on a Windows endpoint. It specifically looks for Event IDs 40300, 40301, or 40302 in conjunction with keywords like 'HybridConnection', 'sb://', 'servicebus.windows.net', or 'HybridConnectionManage'. This service is used to connect on-premises resources to Azure services, and its activity could indicate legitimate cloud integration or potentially malicious use for persistence or data exfiltration.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Detects the use of the PowerShell 'Set-Service' cmdlet to modify the Security Descriptor (DACL) of a Windows service. This modification can be used by adversaries to hide a service from standard enumeration tools like 'sc.exe' or 'Get-Service', aiding in defense evasion and persistence. This technique is noted to be effective in PowerShell 7 and later versions.
Page 8 of 9