Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
3
1
Categories
2
2
1
1
1
Platforms
4
Products / Services
2
1
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This analytic detects processes with command lines containing named pipes. This behavior is often used by adversaries for inter-process communication post-injection, aiding in defense evasion and privilege escalation. The rule specifically excludes processes originating from common program file paths to reduce false positives. If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.
The following analytic detects when a Windows service is modified from a start type to disabled. It leverages system event logs, specifically EventCode 7040, to identify this change. This activity is significant because adversaries often disable security or other critical services to evade detection and maintain control over a compromised host. If confirmed malicious, this action could allow attackers to bypass security defenses, leading to further exploitation and persistence within the environment.
This analytic identifies an excessive number of system events where services are modified from a running or enabled state to a disabled state. It leverages Windows Event Logs (EventCode 7040) to detect multiple service state changes on a single host. This activity is significant as it may indicate an adversary attempting to disable security applications or other critical services, potentially leading to defense evasion or destructive actions. If confirmed malicious, this behavior could allow attackers to disable security defenses, disrupt system operations, and achieve their objectives on the compromised system.
Yara rule that detects Cryakl ransomware.
