Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the loading of a potentially vulnerable or unauthorized third-party kernel driver from outside the standard system driver directory, followed shortly (within 30 minutes) by the termination of security product processes or services. This behavioral pattern is indicative of 'Bring Your Own Vulnerable Driver' (BYOVD) exploitation, often used to impair security tools and blind EDR/antivirus solutions.
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
Detects the modification of the 'ServiceDLL' Registry value for a Windows service to a path that resides outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. This behavior is often associated with service hijacking or persistence techniques where an adversary points a service to a malicious DLL for execution.
Detects persistence mechanisms used by Vidar/SnappyClient (Operation Turb00), specifically the creation of a malicious Windows service named CadenceOptimizer and the hijacking of a Svchost service-group (Brn_Agent) to load a malicious DLL (agt.dll) from the ProgramData directory with SYSTEM privileges.
Detects the creation of a Windows service named 'RageService' using the sc.exe utility, potentially involving associated binary names like 'RageCore_' or 'win_guard_'. This activity is indicative of persistence mechanisms used by malware or unauthorized tools.
Detects execution patterns associated with the DragonReturn loader, which implements a timing delay loop using GetTickCount64 before executing secondary actions, such as deploying a Windows service via sc.exe.
This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.
Detects the creation of a new Windows service where the service executable is located outside of standard system directories (e.g., C:\Windows\ or C:\Program Files\), which is followed by outbound network communication to known SnappyClient C2 ports 3333 or 3334.
Detects indicators of a malicious driver or associated activity named 'pcdhost.sys'. The rule monitors for the installation of this driver via 'sc.exe', registry modifications related to this filename, the creation of this file on disk, and specific suspicious process command-line artifacts ('AtLorenBase', 'MANPO: ReadModule', 'PERS: FAIL', 'RUNPE:', 'POST: hollow=') typically associated with malware or offensive toolkits.
This rule detects the use of 'sc.exe' to interact with services related to 'Mixed Reality' (a potential name masquerading technique) where the parent process is not the standard 'services.exe' or 'svchost.exe'. The rule also correlates this activity with the invocation of command interpreters like 'cmd.exe' or 'conhost.exe' by the parent process, which is highly indicative of malicious service manipulation or lateral movement.
This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.
Detects the creation or configuration of Windows services spawned by WinGet-related processes such as ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is often associated with software installation or configuration management but could be abused by adversaries to establish persistence or execute code with elevated privileges.
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
This rule detects the installation or modification of kernel-mode drivers on Windows systems. It identifies potential driver installation activities using 'sc.exe' to create a service with a kernel-type driver image, or by monitoring Registry 'ImagePath' updates for services that point to '.sys' files, a common method for rootkit or malicious driver persistence.
Detects the use of the Windows service control utility (sc.exe) to install or manage a malicious service named 'MixedSvc'. This activity, which involves pointing the service executable to 'Mixed Reality.exe' located in the Windows Media Player directory, is a persistence technique observed in Operation DragonReturn attributed to the Silver Fox threat group.
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
Detects unauthorized or suspicious installation and configuration of the OpenSSH server on Windows endpoints. This rule monitors for process creation of OpenSSH-related binaries, configuration of SSH services (e.g., via sc.exe, PowerShell, or winget), and modification of SSH-related configuration files and registry keys, which are often indicative of attackers establishing persistent backdoor access.
Detects the installation of a driver service using sc.exe from suspicious, non-standard directories (e.g., Temp, AppData) or involving common driver extensions (.sys). This behavior is indicative of the Bring Your Own Vulnerable Driver (BYOVD) technique, often used to load vulnerable drivers to bypass or disable security products, consistent with activities attributed to various threat actors.
This rule detects when three or more Windows services are created or modified on a single computer within a one-hour period. It specifically looks for Event IDs 4697 (A service was installed in the system) and 7045 (A service was installed in the system). This could indicate malicious activity such as persistence mechanisms or privilege escalation attempts.
Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.
Detects the creation or modification of Windows kernel-mode services using the sc.exe utility when the process is not initiated by the legitimate service control manager (services.exe). This behavior is often associated with the loading of malicious drivers or rootkits, which may attempt to bypass standard service management processes to maintain persistence or elevate privileges.
Page 17 of 41