Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
261 detections
Filters
Last updated
All Time
Detection languages
111
37
37
21
15
Contributors
72
35
28
28
14
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
224
37
4
2
1
Products / Services
84
73
68
49
34
MITRE Techniques
117
99
85
85
77
CVEs
4
2
1
1
1
IDS Classtypes
6
1
IDS Protocols
7
This analytic detects the suspicious disable or modification of system firewalls on Linux systems. Specifically, it looks for `SERVICE_STOP` events for `firewalld` or `ufw` units. This behavior is critical to monitor as it may indicate attempts to gain unauthorized access or maintain control over a system by bypassing network controls. Such actions could be signs of malicious activity, potentially leading to a compromised system, unauthorized access to sensitive data, or a wider network breach. Early detection and response are essential to prevent potential security incidents.
The analytic detects suspicious stopping of the `osquery` service, which may indicate an attempt to disable monitoring and evade detection. `Osquery` is a powerful tool used for querying system information and detecting anomalies, and stopping its service can be a sign that an attacker is trying to disrupt security monitoring or hide malicious activities. By monitoring for unusual or unauthorized stops of the `osquery` service, this analytic helps identify potential efforts to bypass security controls, enabling security teams to investigate and respond to possible threats effectively.
The analytic detects attempts to stop or clear a service on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as adversaries often terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
This analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" or "net.exe" command with the "stop" parameter or the PowerShell "Stop-Service" cmdlet. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response.
The analytic detects the shutdown of the Windows Event Log service by leveraging Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.
The following analytic identifies a suspicious series of command-line executions attempting to disable multiple services. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes where "sc.exe" is used with parameters like "config" or "Disabled" within a short time frame. This activity is significant as it may indicate an adversary's attempt to disable security or other critical services to further compromise the system. If confirmed malicious, this could lead to the attacker achieving persistence, evading detection, or disabling security mechanisms, thereby increasing the risk of further exploitation.
The following analytic detects multiple attempts to stop or delete services on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture.
The analytic detects attempts to disable a service on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" with commands containing "disable." This activity is significant as adversaries may disable security or critical services to evade detection and facilitate further malicious actions, such as deploying destructive payloads. If confirmed malicious, this could lead to the termination of essential security services, allowing attackers to persist undetected and potentially cause significant damage to the system.
This analytic detects the use of the `sfc.exe` utility to stop the Immunet Protect service. The `sfc.exe` utility is part of Cisco Secure Endpoint installation. This detection leverages endpoint telemetry, focusing on command-line executions involving the `-k` parameter. This activity is significant as it indicates potential tampering with defensive mechanisms. If confirmed malicious, attackers could partially blind the EDR, enabling further compromise and lateral movement within the network.
The analytic detects changes in a Windows service's security descriptor where a new deny access control entry (ACE) has been added. It specifically looks for executions of 'sc.exe' with the 'sdset' flag, targeting any service, and including a deny ACE. Such modifications can be used by attackers to escalate privileges, disable security services, or blind defenses by preventing legitimate users or services from interacting with the modified service.
The following analytic detects the stopping of the Windows Security Account Manager (SAM) service via command-line, typically using the "net stop samss" command. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because stopping the SAM service can disrupt authentication mechanisms and is often associated with ransomware attacks like Ryuk. If confirmed malicious, this action could lead to unauthorized access, privilege escalation, and potential system-wide compromise.
The following analytic detects when a Windows service is modified from a start type to disabled. It leverages system event logs, specifically EventCode 7040, to identify this change. This activity is significant because adversaries often disable security or other critical services to evade detection and maintain control over a compromised host. If confirmed malicious, this action could allow attackers to bypass security defenses, leading to further exploitation and persistence within the environment.
This analytic identifies an excessive number of system events where services are modified from a running or enabled state to a disabled state. It leverages Windows Event Logs (EventCode 7040) to detect multiple service state changes on a single host. This activity is significant as it may indicate an adversary attempting to disable security applications or other critical services, potentially leading to defense evasion or destructive actions. If confirmed malicious, this behavior could allow attackers to disable security defenses, disrupt system operations, and achieve their objectives on the compromised system.
The following analytic identifies attempts to stop services on a system using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection and Response (EDR) telemetry. This activity can be significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise.
This analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
This analytic detects when critical Windows Update services, specifically "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update," have their start mode changed to 'disabled.' It uses Windows System Event ID 7040 logs to identify these changes. Disabling these services can be an adversary's tactic to prevent system updates, thereby maintaining persistence and exploiting unpatched vulnerabilities, compromising system integrity and security.
Detects the stopping of system firewall services (firewalld, iptables, ufw) on Linux systems. Adversaries may disable firewalls to bypass network controls, facilitate C2 communications, lateral movement, or data exfiltration.
Detects when the 'Windows Defender Threat Protection' service is disabled or stopped. This event is triggered when the service state changes to stopped, which could indicate an attempt to impair defenses.
Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.
Detects the unexpected termination of important Windows services, specifically targeting 'Message Queuing' (MSMQ) service. This could indicate an attempt to disrupt critical system functions or evade detection by stopping services that might be monitoring activity or providing essential communication channels.
This rule detects the termination of important Windows services, such as antivirus, firewall, Microsoft Defender components, BitLocker, and Encrypting File System (EFS). It specifically looks for Event ID 7023 from the 'Service Control Manager' provider, indicating a service termination with an error. The rule identifies critical services by their display names (which can be language-specific) or by their wide hex-encoded service names in the 'Binary' field of the event.
Page 12 of 13