Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the creation or modification of a Windows service to belong to a high-priority service group.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (A service was installed in the system). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
Detects execution of the Kernel Driver Utility (KDU) tool.
KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.
Potentially allowing for privilege escalation, persistence, or evasion of security controls.
KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.
Potentially allowing for privilege escalation, persistence, or evasion of security controls.
Detects the creation of a Windows service named "NSecRTS" with the display name "Windows Real-time Protection Service" and an executable path in a suspicious "NSEC" folder. This behavior is associated with a China-linked RAT observed in an Indian Income Tax-themed phishing campaign.
Detects the creation of a persistent GitHub self-hosted runner named 'SHA1HULUD', a technique used by the Shai-Hulud 2.0 malware for persistence and remote command execution. The rule specifically looks for process command lines containing " --name SHA1HULUD".
This rule detects the creation of new Windows services where the executable path is suspicious. Suspicious paths include common temporary or user-writable directories like `Users\Public`, `ProgramData`, `AppData`, or `Windows\Temp`. Additionally, it flags services that directly execute `cmd.exe` or `powershell.exe` with suspicious arguments (e.g., encoded commands, hidden windows, or `/c` for command execution), or `rundll32.exe` from suspicious paths. It also identifies services with very short, alphanumeric names, which could indicate an attempt at masquerading.
Detects the creation of a Windows service with a suspicious name or an executable path in an unusual location, a technique used by APT41 for persistence.
Detects the installation of the Velociraptor agent as a Windows service, a technique used by threat actors for persistence and command and control (C2).
Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.
Detects the execution of Cloudflared with command-line arguments associated with creating a persistent tunnel or installing it as a service. This technique is used by the Kraken ransomware group for persistence and command and control.
A composite detection rule that identifies multiple techniques, tactics, and procedures (TTPs) associated with the RansomHub intrusion detailed in "The DFIR Report". This rule focuses on process creation events and flags the execution of specific credential dumping tools, network scanners, defense evasion commands, ransomware behaviors, and exfiltration tool chains. An alert from this rule indicates a high probability of malicious activity consistent with this threat actor's methodology.
Detects service path modification via the "sc" binary to a suspicious command or path
This rule detects the loading of known vulnerable drivers by their file names. Adversaries often leverage these vulnerable drivers to achieve privilege escalation or persistence on a system, typically by exploiting a known vulnerability in the driver to execute arbitrary code in kernel mode. The list of driver file names included in the detection logic corresponds to drivers identified as vulnerable, often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.
Detects the installation of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools for persistence, privilege escalation, and remote control of compromised systems.
Detects known malicious service installations associated with Cobalt Strike beacons, often used for privilege escalation or lateral movement. The rule specifically looks for patterns in the ServiceFileName field of Windows Security Event ID 4697, such as the presence of 'ADMIN$' and '.exe', '%COMSPEC%', 'start', and 'powershell', or encoded PowerShell commands often used by Cobalt Strike.
Detects the installation of a PDQDeploy service on a target system. When a package is deployed via PDQDeploy, it installs a remote service named "PDQDeployRunner-X" (where X is an integer) on the target machine.
Detects the loading of known malicious drivers by their MD5, SHA1, SHA256, or IMPHASH. These drivers are often used by adversaries for persistence and privilege escalation, particularly in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks to gain kernel-level access.
This rule detects the loading of known malicious drivers by their file names. Adversaries often use malicious drivers for persistence, privilege escalation, or to evade defenses. The rule specifically looks for a predefined list of driver filenames that have been identified as malicious or associated with vulnerable drivers exploited by attackers. This detection is based on the 'ImageLoaded' field, which indicates when a driver is loaded into the system.
Page 30 of 41