Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
234 detections
Filters
Last updated
All Time
Detection languages
91
65
32
11
10
Contributors
44
31
29
23
20
Categories
88
86
85
64
29
Platforms
184
28
17
6
5
Products / Services
49
49
38
38
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
IDS Classtypes
3
1
IDS Protocols
3
1
The analytic detects attempts to stop or clear a service on Linux systems. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as adversaries often terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
This analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" or "net.exe" command with the "stop" parameter or the PowerShell "Stop-Service" cmdlet. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response.
This analytic detects the termination of specific processes, namely "PServiceControl.exe" and "PService_PPD.exe", which are known targets of the Industroyer2 malware. The detection relies on Sysmon EventCode 5, indicating a process termination event. This activity is highly indicative of an attack on critical infrastructure, particularly energy facility networks, as these processes are related to industrial control systems. Such an attack could lead to severe disruption of essential services and operational control. Immediate investigation is crucial to determine the cause and mitigate potential threats.
The following analytic detects anomalous changes in resource utilization ratios for processes running on a Kubernetes node. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, analyzed through Splunk Observability Cloud. The detection uses a lookup table containing average and standard deviation values for various resource ratios (e.g., CPU:memory, CPU:disk operations). Significant deviations from these baselines may indicate compromised processes, malicious activity, or misconfigurations. If confirmed malicious, this could signify a security breach, allowing attackers to manipulate workloads, potentially leading to data exfiltration or service disruption.
The following analytic identifies a suspicious series of command-line executions attempting to disable multiple services. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes where "sc.exe" is used with parameters like "config" or "Disabled" within a short time frame. This activity is significant as it may indicate an adversary's attempt to disable security or other critical services to further compromise the system. If confirmed malicious, this could lead to the attacker achieving persistence, evading detection, or disabling security mechanisms, thereby increasing the risk of further exploitation.
The analytic detects the deletion of a service from the Windows Registry under CurrentControlSet\Services. It leverages data from the Endpoint.Registry datamodel, specifically monitoring registry paths and actions related to service deletion. This activity is significant as adversaries may delete services to evade detection and hinder incident response efforts. If confirmed malicious, this action could disrupt legitimate services, impair system functionality, and potentially allow attackers to maintain a lower profile within the environment, complicating detection and remediation efforts.
The following analytic detects multiple attempts to stop or delete services on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture.
The analytic detects attempts to disable a service on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" with commands containing "disable." This activity is significant as adversaries may disable security or critical services to evade detection and facilitate further malicious actions, such as deploying destructive payloads. If confirmed malicious, this could lead to the termination of essential security services, allowing attackers to persist undetected and potentially cause significant damage to the system.
The analytic detects changes in a Windows service's security descriptor where a new deny access control entry (ACE) has been added. It specifically looks for executions of 'sc.exe' with the 'sdset' flag, targeting any service, and including a deny ACE. Such modifications can be used by attackers to escalate privileges, disable security services, or blind defenses by preventing legitimate users or services from interacting with the modified service.
The following analytic detects the stopping of the Windows Security Account Manager (SAM) service via command-line, typically using the "net stop samss" command. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because stopping the SAM service can disrupt authentication mechanisms and is often associated with ransomware attacks like Ryuk. If confirmed malicious, this action could lead to unauthorized access, privilege escalation, and potential system-wide compromise.
The following analytic detects when a Windows service is modified from a start type to disabled. It leverages system event logs, specifically EventCode 7040, to identify this change. This activity is significant because adversaries often disable security or other critical services to evade detection and maintain control over a compromised host. If confirmed malicious, this action could allow attackers to bypass security defenses, leading to further exploitation and persistence within the environment.
This analytic identifies an excessive number of system events where services are modified from a running or enabled state to a disabled state. It leverages Windows Event Logs (EventCode 7040) to detect multiple service state changes on a single host. This activity is significant as it may indicate an adversary attempting to disable security applications or other critical services, potentially leading to defense evasion or destructive actions. If confirmed malicious, this behavior could allow attackers to disable security defenses, disrupt system operations, and achieve their objectives on the compromised system.
The following analytic identifies attempts to stop services on a system using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection and Response (EDR) telemetry. This activity can be significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise.
This analytic detects when critical Windows Update services, specifically "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update," have their start mode changed to 'disabled.' It uses Windows System Event ID 7040 logs to identify these changes. Disabling these services can be an adversary's tactic to prevent system updates, thereby maintaining persistence and exploiting unpatched vulnerabilities, compromising system integrity and security.
The following analytic detects the deletion of Linux service unit configuration files by suspicious processes. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on processes executing the 'rm' command targeting '.service' files. This activity is significant as it may indicate malware attempting to disable critical services or security products, a common defense evasion tactic. If confirmed malicious, this behavior could lead to service disruption, security tool incapacitation, or complete system compromise, severely impacting the integrity and availability of the affected Linux host.
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
Detect when multiple GCP Service APIs are disabled in a short period of time.
Yara rule that detects Helldown ransomware.
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities. This rule specifically looks for `schtasks.exe` being used with the `/Change`, `/TN`, and `/disable` arguments, targeting important system tasks like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate.
This rule identifies when an Azure VPN connection is either modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE' (modification) or 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE' (deletion) operations. Such actions can indicate an attempt to disrupt network connectivity or reconfigure access to cloud resources, potentially as part of an impact-oriented attack or unauthorized access.
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
Page 10 of 12