Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the creation or modification of a file named 'g11.sys'. This filename is often associated with the deployment of malicious or vulnerable drivers used for kernel-mode exploitation, such as Bring Your Own Vulnerable Driver (BYOVD) attacks or rootkit activity.
Detects the creation of a new Windows service where the service binPath points to 'anydesk.exe', optionally accompanied by a system reboot command within one hour of the service creation. This behavior is often associated with the installation or persistent configuration of remote access software.
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
This rule detects the registration of the 'CipherAllocator' Windows service associated with the TELEPUZ malware. It monitors registry modifications related to service creation, specifically identifying the usage of 'grpeng.dll' from a suspicious path ('C:\ProgramData\XeroxPrint\Temp\Worker\') and specific 'svchost' registry configurations used for persistence.
Detects the creation or modification of a Windows service named 'ThumbcacheService', which has been associated with the GoSerpent campaign for file collection. The rule monitors both registry modifications indicative of service installation and process execution patterns using sc.exe, reg.exe, powershell.exe, or cmd.exe that reference this specific service name.
This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
Detects instances where PowerShell is executed with common bypass flags by a process masquerading as or spawned by 'svchost.exe' located in non-standard system directories, specifically targeting executions originating from user-writable temporary locations.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
Detects a process that simultaneously loads 'RstrtMgr.dll' and modifies the 'WaitToKillServiceTimeout' registry value within a 2-minute window. This behavior is indicative of an adversary attempting to force system service restarts or accelerate service termination, often seen as part of persistence mechanisms or defensive impairment.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detects the creation of a Windows service associated with the AnyDesk remote access application using the sc.exe utility. This behavior often indicates the unauthorized installation or persistence setup of a remote access tool.
Detects the creation or starting of an AnyDesk service using command-line arguments to specify custom configuration directories or service names. This pattern is often used by adversaries to establish persistence or ensure remote access tools are configured with specific, potentially silent or pre-defined, settings.
Detects the installation and service creation of the Nezha agent, a monitoring tool often abused by threat actors to establish persistent backdoors on compromised systems.
This rule detects the creation of a Windows service named 'SecurityHealthIron' using the sc.exe utility or direct service creation calls. This specific naming convention is often associated with suspicious or potentially malicious activity attempting to masquerade as a legitimate Windows Security Health service.
Detects the Snowlight dropper (UNC5221) installing a new Windows service named 'Windows Update Service' that utilizes a non-standard executable file named 'wusvc.exe' to achieve persistence and masquerade as the legitimate Windows Update service (wuauserv).
Detects the creation of a Windows service named 'wsftprm'. This specific service name is often associated with malicious activities, particularly in historical cases involving persistent threats or unauthorized software installation.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
This rule detects the creation of Windows services or scheduled tasks that reference known file paths, names, or command-line indicators associated with the Turb00 loader, HijackLoader, SnappyClient, or Vidar malware families. It utilizes Windows Event logs (4697/4698) and Sysmon process creation events to identify persistence mechanisms being established by these threats.
Page 16 of 41