Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
This rule detects the usage of standard Windows system administration utilities (infinstall.exe, devcon.exe, pnputil.exe, sc.exe) when the command line arguments include keywords commonly associated with driver loading or kernel-level operations, which may indicate the installation of a rootkit or malicious driver.
Detects a manual kernel mapper referencing a Fonts-hosted encrypted driver and PE relocation APIs. The rule looks for specific strings often associated with malicious kernel-mode operations, including references to the Windows Fonts directory, and API calls like ZwAllocateVirtualMemory, RtlImageNtHeader, MmGetSystemRoutineAddress, and DriverEntry, which are indicative of dynamic driver loading and PE header manipulation.
This rule correlates the creation and subsequent removal of a driver service within a 15-minute window. It specifically looks for registry events indicating the creation and deletion of a service key, where the service's image path ends with '.sys' or the key name contains 'msidiskserver'. This behavior is indicative of the transient driver-loading workflow used by SprySOCKS malware.
Detects creation of new Windows services for persistence
Detects the creation of a persistent Windows service using 'sc.exe' that masquerades as 'OneDriveServers' to potentially run ScreenConnect, as observed in Operation SilentCanvas. This rule specifically looks for the 'sc.exe' utility being used with 'create' and 'OneDriveServers' in its command line arguments.
Targets service registration for msidiskserver or an ImagePath ending in fsdiskbit.sys. The UDM rule retains principal and target context for correlation.
This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.
Detects deceptive registration using the exact string 'Microsoft Update Service' mapped to non-Microsoft binaries in non-standard paths. This could indicate an adversary attempting to masquerade malicious activity as legitimate system services.
Correlates the creation of arbitrary new Windows services via sc.exe with immediate subsequent execution of binaries located in Public or ProgramData directories. This behavior is indicative of an attacker establishing persistence on a system by creating a malicious service that executes from a common writable location.
Detects the creation or modification of the CadenceOptimizer service registry keys, indicating Vidar Turb00 persistence via a dropped secondary payload. This rule specifically looks for registry events affecting the 'CadenceOptimizer' service path.
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
This rule detects the creation of new Windows services (EventID 7045) where the service executable path does not reside in a standard System32 directory (unless it's in a Temp directory) and the executable name contains common scripting interpreters like 'powershell', 'cmd', or 'cscript'. This pattern is often indicative of persistence mechanisms established by adversaries using scripting languages.
This rule detects two types of suspicious process activity. The first part identifies common Windows processes (svchost.exe, explorer.exe, system.exe, services.exe) executing with command lines that suggest driver loading or manipulation (e.g., containing 'driver', '.sys', 'load', 'unsigned', 'disabled UAC'). It flags instances where such activity occurs frequently (5 or more times) within a short timeframe (2 hours) and involves at least one unique driver file. The second part of the rule detects suspicious process termination attempts where specific legitimate Windows processes (MpCmdRun.exe, MsSense.exe, PsExec.exe, rundll32.exe) are observed attempting to terminate critical system processes (svchost.exe, lsass.exe, csrss.exe) multiple times.
Detects creation of new Windows services for persistence
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
Detects references to the misspelled service 'MicrosoftUpdateSerice' during service creation or manipulation within process command lines. This specific misspelling has been associated with the MuddyWater APT group.
This rule detects suspicious command-line activity indicative of direct kernel object manipulation, often associated with kernel-mode rootkits. It looks for processes executing commands containing keywords related to direct kernel access (e.g., 'directl', 'kernel call', 'ntoskrnl', 'hal.dll') in conjunction with keywords suggesting privilege escalation or driver loading (e.g., 'setprivileges', 'loaddriver', 'createremotethread'). Such combinations can signify attempts to install or interact with malicious kernel drivers or rootkits.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
This rule detects two types of suspicious process activity. The first part identifies common Windows processes (svchost.exe, explorer.exe, system.exe, services.exe) executing with command lines that suggest driver loading or manipulation (e.g., containing 'driver', '.sys', 'load', 'unsigned', 'disabled UAC'). It flags instances where such activity occurs frequently (5 or more times) within a short timeframe (2 hours) and involves at least one unique driver file. The second part of the rule detects suspicious process termination attempts where specific legitimate Windows processes (MpCmdRun.exe, MsSense.exe, PsExec.exe, rundll32.exe) are observed attempting to terminate critical system processes (svchost.exe, lsass.exe, csrss.exe) multiple times.
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
Page 26 of 41