Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
22
5
3
1
Contributors
8
8
5
4
2
Categories
16
9
8
7
6
Platforms
20
12
3
3
Products / Services
10
6
5
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
Detects the creation or configuration of a Windows service using 'sc.exe' executed via 'cmd.exe', specifically looking for commands containing 'create' or 'config' along with 'binpath'. This activity can indicate persistence mechanisms or privilege escalation attempts by adversaries.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (A service was installed in the system). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
The analytic detects the creation of a Windows service named "Sliver" with the description "Sliver Implant," indicative of SliverC2 lateral movement using the PsExec module. It leverages Windows EventCode 7045 from the System Event log to identify this activity. This behavior is significant as it may indicate an adversary's attempt to establish persistence or execute commands remotely. If confirmed malicious, this activity could allow attackers to maintain control over the compromised system, execute arbitrary code, and further infiltrate the network.
This KQL query detects suspicious service activities (installation, modification, or deletion) by comparing events with a curated list of known suspicious Windows services. It extracts service names and accounts from device events and joins them with an external CSV list of suspicious services to identify matches. The query aims to alert on the presence or manipulation of services commonly associated with malicious activity.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query
KQL Query
KQL Query from file: Detecting Copilot Studio Bot Creation
'Looks for new device registrations following a risky user account sign-in. By default the
query will use a 6 hour lookback period, this can be configured within the query.'
query will use a 6 hour lookback period, this can be configured within the query.'
'This hunting query looks for new Service Principals running queries that have not previously been seen running queries.'
'Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx().
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
Page 1 of 2