Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
261 detections
Filters
Last updated
All Time
Detection languages
111
37
37
21
15
Contributors
72
35
28
28
14
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
224
37
4
2
1
Products / Services
84
73
68
49
34
MITRE Techniques
117
99
85
85
77
CVEs
4
2
1
1
1
IDS Classtypes
6
1
IDS Protocols
7
This rule detects attempts to stop the Microsoft Defender Antivirus service (MsMpEng) remotely via the Server Message Block (SMB) protocol on port 445. The detection is triggered by the presence of "StopService" and "MsMpEng" (case-insensitive) within the TCP payload, indicating a potential defense evasion tactic.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
Monitors for unexpected process termination or instability events associated with the Windows Netlogon service or lsass.exe (Event IDs 1000, 7031, 7034). This may indicate a failed buffer overflow exploitation attempt related to CVE-2026-41089, which could lead to a denial of service.
This rule detects attempts to remotely create or modify services on a target system via SMB, specifically looking for the 'CreateService' string within TCP traffic on port 445. It thresholds on 3 occurrences from the same source within 60 seconds to reduce false positives.
This rule detects repeated crashes and restarts of the SolarWinds Serv-U application, indicated by specific event log entries from 'Service Control Manager' or 'Application Error' sources. This pattern is consistent with known exploitation attempts targeting Serv-U.
Remote Service Stop via SMB
Suricata
This rule detects attempts to remotely stop a service via SMB (Server Message Block) by looking for the 'svcctl' and 'StopService' strings in TCP traffic on port 445. This activity is often associated with trojan activity or other malicious impact operations.
This rule detects potential log tampering activities on Linux systems followed by service manipulation within a 20-minute window on the same host.
Detects attempts to query, stop, or disable the legacy UI0Detect (Interactive Services Detection) service using the 'sc.exe' utility. This behavior was observed in the Lotus Wiper destructive campaign to suppress interactive service warnings before wiping the system.
This rule detects when critical services, including security agents, backup solutions, and remote management tools, are stopped on a host. Adversaries often stop these services to evade detection, disable security controls, or inhibit system recovery during attacks like ransomware.
Detects log file modification followed by service manipulation to cover tracks.
Used /dev/null, therefore it acts as a stronger version of disable
Used /dev/null, therefore it acts as a stronger version of disable
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.
Detects when the "Windows Defender Threat Protection" service is disabled.
Detects important or interesting Windows services that got terminated unexpectedly.
Detects disabling security tools
Detects Windows services that got terminated for whatever reason
Detects important or interesting Windows services that got terminated for whatever reason
Detects mass service termination targeting backup, database, and virtualization services. The Gentlemen stop Veeam, SQL, Oracle, SAP, Acronis, BackupExec, PostgreSQL, Docker, and VMware services before encryption.
Detects the execution of sc.exe or reg.exe to create or modify specific Windows services to point to a malicious DLL. This technique is used by the Silver Dragon APT group to hijack legitimate services like 'bthsrv' and 'wuausrv' for persistence.
Detects attempts to disable or stop syslog services (syslog, rsyslog, syslog-ng) using common system utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses by preventing logging of their actions.
Detects attempts to disable or stop the 'auditd' service on Linux systems using common service management utilities like systemctl, service, chkconfig, or update-rc.d. This activity could indicate an adversary attempting to impair defenses and avoid logging of their malicious actions.
Detects when the Windows Admin Center service ('SmeSvc.exe') is stopped, and shortly thereafter, a different process starts listening on the WAC port (TCP/6516). This behavior is a key indicator of CVE-2026-20965 exploitation, where an attacker impersonates the service to steal administrator access tokens.
Page 10 of 13