Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
68
33
18
16
13
Contributors
35
33
27
19
11
Categories
20,396
11,792
5,863
5,144
4,864
Platforms
139
40
6
4
2
Products / Services
48
36
29
25
20
MITRE Techniques
119
91
80
77
46
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the use of the PowerShell 'Set-Service' cmdlet to modify a service's security descriptor (SDDL) to include 'DCLCWPDTSD'. This specific SDDL string is known to hide services from common utilities like 'sc.exe' and 'Get-Service', effectively making them invisible. This technique is primarily effective in PowerShell 7 and later versions.
Detects the usage of the "net.exe" or "net1.exe" command-line utility to start a Windows service using the "start" flag. This activity can be indicative of an adversary executing a service, potentially for persistence or privilege escalation.
Detects the use of the 'sc.exe' utility to change the startup type of a Windows service to 'disabled' or 'demand'. This action can be used by adversaries to impair defenses or prevent legitimate services from starting.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the usage of wmic.exe to start or stop a Windows service. This activity can be indicative of an adversary attempting to manipulate system services for various malicious purposes, such as persistence, privilege escalation, or defense evasion. While wmic.exe is a legitimate system tool, its use to control services should be monitored, especially when originating from unusual processes or user contexts.
Rule to detect the Hybrid Connection Manager service running on an endpoint.
Detects installation or execution of services
Page 9 of 9