Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
2
2
2
1
Platforms
4
Products / Services
2
1
MITRE Techniques
3
1
1
1
1
CVEs
71
71
64
58
49
Detects important or interesting Windows services that got terminated unexpectedly.
Detects corrupted packets sent to the MSMQ service, which could indicate an attempt to exploit CVE-2023-21554, a critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The rule specifically looks for EventID 2027 with a Level of 2 (Error) from the 'MSMQ' provider in the Windows Application event log.
This rule detects potential exploitation of CVE-2023-21554, dubbed 'QueueJumper'. The vulnerability allows for unauthorized remote code execution within the MSMQ service. The rule specifically looks for the 'mqsvc.exe' process (Microsoft Message Queuing service) spawning common Windows command-line interpreters or scripting engines, which would indicate an attempt to execute arbitrary code.
Detects the unexpected termination of important Windows services, specifically targeting 'Message Queuing' (MSMQ) service. This could indicate an attempt to disrupt critical system functions or evade detection by stopping services that might be monitoring activity or providing essential communication channels.