Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Identifies the malicious RMM establishing persistence by creating a system service configured to auto-start the backdoor on reboot. The rule specifically looks for the 'sc.exe' utility being used to create a service with a binary path pointing to an executable within the 'AppData' directory and configured for automatic startup.
Detects evidence of the BeepRAT malware (via known file names, loader behavior, and specific command-line arguments) and attempts to tamper with security software through process termination, service modification, or the addition of Windows Defender exclusions.
This rule detects the creation of a new Windows service where the executable path is located in suspicious directories (e.g., ProgramData, AppData, Temp, Users Public). It correlates the service installation event (using sc.exe) with the subsequent execution of the binary by services.exe within a two-hour window, identifying potential persistence mechanisms or malicious service-based execution.
Detects the creation of Windows services where the executable path is located in suspicious or volatile directories such as ProgramData, Temp, or AppData. This behavior is indicative of malware, specifically the The Gentlemen RaaS group, establishing persistence or deploying malicious components on a compromised system.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
Detects the installation of RustDesk as a persistent Windows service. RustDesk is a remote access tool that has been observed in intrusion chains, including those involving Akira ransomware, to provide hands-on-keyboard access to threat actors.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.
Detects the installation of 'cloudflared.exe' as a Windows service from a non-standard file path. The rule specifically correlates this service installation with preceding PowerShell commands typically used to download remote files, consistent with tradecraft observed in Akira and Bumblebee campaigns to establish covert C2 tunneling.
Detects the installation of the Cloudflare Tunnel (cloudflared) utility as a Windows service, often used by threat actors to establish persistent, outbound command-and-control (C2) channels that bypass standard network perimeter controls. This rule monitors for PowerShell-based downloads from GitHub, silent MSI-based installation, and the execution of the 'service install' command.
This rule detects the deployment and activity associated with the TrueSightKiller rootkit, potentially used by threat actors like SilverFox. It identifies several key indicators: the loading of 'truesight.sys' from non-standard directories, the creation of a staging file named 'ranchserv.jpg' in the Windows Temp directory by non-system processes, the presence of the 'truesight.sys' driver based on its known SHA256 hash, and the termination of security products shortly after the creation of TrueSightKiller-related artifacts.
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or start a service on a remote host, identified by the presence of UNC paths (\\) and service management commands (create, start) in the command line.
This rule detects the creation and loading of the 'NSecKrnl.sys' driver file on a system. The filename is associated with potentially malicious or unauthorized kernel-level activity, often indicative of rootkit behavior or unauthorized persistence mechanisms.
This rule detects the creation and loading of the 'NSecKrnl.sys' driver file on a system. The filename is associated with potentially malicious or unauthorized kernel-level activity, often indicative of rootkit behavior or unauthorized persistence mechanisms.
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Detects the installation of a new Windows service where the ImagePath contains strings commonly associated with remote access or remote control software, such as 'remotepc' or 'rpclient'. This may indicate the unauthorized deployment of remote administration tools.
Detects the installation, service creation, registry modification, and network activity associated with the Tailscale VPN tool. This rule monitors for persistent use of Tailscale, which can be utilized by threat actors to establish encrypted mesh access to internal environments.
Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.
This rule detects the creation of new processes (Event ID 4688) where the command line contains keywords indicative of driver or kernel module installation or loading. It looks for combinations of terms like 'driver', 'kernel', 'sys' along with 'install' or 'load'. This activity can be a sign of rootkit installation or other malicious kernel-level modifications.
Page 20 of 41