Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Detects the creation or modification of Windows services using sc.exe where the binary path (binpath) points to suspicious or user-writable directories such as User profiles, AppData, Temp, or Public folders, which are often used by adversaries for persistence or privilege escalation.
Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.
Detects the creation of a Windows kernel-mode driver service where the driver binary is located in a suspicious, non-standard directory like Temp, Public, or AppData. This is a common persistence technique for malware, including EDR killers that use vulnerable drivers.
This rule detects attempts to tamper with Windows Defender services (WinDefend, SecurityHealthService, wscsvc) by stopping or disabling them. It covers actions performed via 'sc.exe' commands, 'Set-Service' PowerShell cmdlets, and direct modification of registry keys related to these services. The rule specifically filters out legitimate system and TrustedInstaller processes when detecting registry modifications to reduce false positives.
This rule detects the installation of known vulnerable kernel drivers (Bring Your Own Vulnerable Driver - BYOVD). These drivers are often exploited by adversaries to gain kernel-level code execution, elevate privileges, or disable security tools (EDR).
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
Detects the sc.exe utility creating a kernel-mode driver service pointing to a newly dropped .sys file in a temporary user directory. This activity is indicative of Bring Your Own Vulnerable Driver (BYOVD) techniques, often used by attackers to gain kernel-mode privileges and bypass security solutions.
Detects the SNOWLIGHT dropper (UNC5221) masquerading as the Windows Update service (wusvc.exe). It monitors for the creation of a Windows service named 'wusvc' or 'Windows Update Service' located outside of standard system directories, and the execution of 'wusvc.exe' from user-writable directories like AppData, Temp, or Downloads, indicating potential malicious persistence or dropper activity.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
Detects the execution of CbsMsgApi.exe, which is the initial loader used by the REF4033 group to install the BADIIS IIS module and create a persistence service. The detection is based on the specific filename or the known MD5 hash of the loader.
Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
Detects the installation of the OpenSSH Server feature or the creation of an 'sshd' service on Windows workstations. Adversaries may install OpenSSH as a persistent, covert backdoor to maintain access to a compromised host.
Detects the creation of a named object with the specific name 'MakeAmericaGreatAgain'. This string has been associated with various malware and potentially unwanted programs, often used as a mutex or other synchronization object to ensure only one instance of the malicious process is running.
Detects the creation of new services or modification of service configurations using command-line tools (sc.exe, PowerShell) spawned by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. This activity is indicative of potential privilege escalation or persistence mechanisms being established under the context of legitimate Windows components.
Detects the creation of Windows services or modification of service configurations triggered by WinGet DSC-related processes (ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe). This pattern is often associated with the DSCourier persistence technique, where adversaries leverage the Desired State Configuration (DSC) framework to maintain a presence on a compromised host.
Detects suspicious service-based persistence activity associated with JFMBackdoor, specifically when fltMC.exe (a known host process) initiates child processes sc.exe or services.exe to create or start a service, using file paths located in C:\ProgramData\Microsoft\Network and specific registry key modification patterns.
Detects the creation or modification of Windows services using sc.exe or PowerShell New-Service where the binary path points to suspicious user-writable directories such as Temp or AppData, a technique observed in the Red Lamassu JFMBackdoor infection chain.
Detects a suspicious sequence where DllHost.exe writes an executable or script to a common public directory (such as C:\Users\Public\, C:\Windows\Temp\, or C:\ProgramData\), followed by the execution of that file within 30 minutes by a system process (svchost.exe or services.exe), often indicative of a scheduled task or service-based persistence mechanism.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
Page 22 of 41