Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
This rule detects SMB traffic indicative of remote service creation over the SVCCTL named pipe, a pattern characteristic of tools like PsExec used for lateral movement and remote code execution.
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
Detects the installation and operation of the RustDesk remote access tool as a persistent Windows service. This behavior has been identified in the Akira ransomware intrusion chain where adversaries utilize remote access tools for post-compromise persistence and control. The rules monitor for service creation via command-line utilities (sc.exe, PowerShell), registry modifications related to service configurations, and Windows Service Control Manager events (Event ID 7045) that register RustDesk as a persistent system service.
Detects instances where the Microsoft Defender service (MsMpEng.exe) spawns common system utilities like cmd.exe, powershell.exe, or wscript.exe running with SYSTEM integrity. This is highly anomalous as Defender should generally not be the parent process for these interactive or script execution shells.
This rule detects the installation of a new Windows service by monitoring Security Event IDs 4697 and 601. It extracts details about the service name, file path, and account used. The rule flags services that have suspicious binary paths, such as those within user-writable directories (Temp, AppData, Downloads) or paths containing common living-off-the-land binaries, which may indicate persistence or the loading of malicious drivers.
This rule detects the creation of a new Windows service (EventID 7045) where the service executable path contains both 'System32' and 'svchost', and the service description is either empty or contains 'Network'. This combination of characteristics can indicate the installation of a malicious service, potentially a backdoor or trojan, attempting to masquerade as a legitimate system service.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
This rule detects the creation of a Windows service where the service type is set to 'kernel' via the sc.exe command-line utility. This behavior is indicative of an attempt to load a kernel driver or perform low-level system modifications, which is often used by rootkits or malicious drivers. The rule filters out known trusted publishers to reduce noise.
Detects GreenBlood ransomware attempting to establish persistence by creating a new Windows service. This rule identifies suspicious 'sc.exe' commands that include 'green' or 'blood' in the service name, or 'sc.exe' commands creating services from common temporary/application data paths. It also looks for direct registry modifications to the Services key with 'green' or 'blood' in the key name.
Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.
Detects the creation of a Windows service using the 'sc.exe' utility where the service executable is located in a potentially untrusted directory such as Temp, AppData, ProgramData, Users\Public, or Downloads. This behavior is frequently used by adversaries to establish persistence or execute malicious code with elevated privileges.
Detects the creation or modification of a Windows service named 'MixedSvc' or containing 'Mixed Reality' in the command line where the binPath points to a non-System32 directory or the Windows Media Player folder, which is indicative of potential service hijacking or persistence techniques.
Detects the creation or modification of Windows Registry keys or values within the 'CurrentControlSet\Services' path that refer to 'rustdesk'. This typically indicates the installation or configuration of the RustDesk remote access tool as a system service, which may be unauthorized or used for persistence by an adversary.
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
This rule detects the installation of known vulnerable kernel drivers (Bring Your Own Vulnerable Driver - BYOVD). These drivers are often exploited by adversaries to gain kernel-level code execution, elevate privileges, or disable security tools (EDR).
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects the creation of persistence via a malicious Windows service named 'MixedSvc' or any service pointing to 'Mixed Reality.exe' located within 'C:\Program Files\Windows Media Player\'. This activity is consistent with the 'Operation DragonReturn' campaign and the 'Silver Fox' threat actor, where the 'Mixed Reality.exe' binary acts as a host for DLL-sideloading of the DcRAT backdoor.
Page 19 of 41