Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the installation of a Windows service by the Sliver C2 framework. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, combined with an ImagePath characteristic of Sliver (an executable in the Windows temporary directory with a 10-character alphanumeric name) or a ServiceName explicitly identifying as 'Sliver' or 'Sliver implant'. This behavior is often observed when Sliver implants use tools like PsExec to establish persistence.
Detects the load of the WinRing0 driver, which is known to be vulnerable and has been exploited by threat actors, crypto miners (like XMRIG), and other malware for privilege escalation. The detection is based on specific file names or a known IMPHASH associated with the driver.
Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
Detects the creation of a new Windows service where the client process or its parent process has a Process ID (PID) of 0. A PID of 0 typically indicates the System Idle Process, which should not be initiating service installations. This behavior can be indicative of highly privileged malware or rootkits attempting to establish persistence or escalate privileges by creating services in an unusual context.
This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a '
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Detects non-system users performing privileged operations on the Service Control Manager (SCM) database, specifically taking ownership of the 'servicesactive' object. This could indicate an attempt to manipulate Windows services for privilege escalation or persistence.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
Detects the load of HackSys Extreme Vulnerable Driver (HEVD.sys), an intentionally vulnerable Windows driver often abused by threat actors for privilege escalation and other malicious activities. The rule identifies the driver by its filename and known IMPHASH values.
Detects the installation of a PDQDeploy service on a machine. PDQDeploy is a legitimate system management tool that can be leveraged by attackers to remotely install packages or execute commands on target machines, leading to persistence or privilege escalation.
Detects the creation of new Windows services that exhibit characteristics commonly associated with Cobalt Strike beacon activity, specifically focusing on suspicious ImagePath values. This includes services created with paths pointing to ADMIN$ shares, PowerShell commands for execution, or encoded PowerShell commands often used for downloading and executing payloads.
This rule detects the installation or start of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools to maintain persistence, escalate privileges, or establish command and control over compromised systems. The rule specifically looks for Event IDs 7045 (Service Installation) and 7036 (Service Started) from the 'Service Control Manager' provider, where the service name contains keywords indicative of known remote access software such as AmmyyAdmin, TeamViewer, LogMeIn, and others.
This rule detects the creation of specific Windows services ('srservice', 'ipvpn', 'hkmsvc') that have been identified as malicious by ESET in their 'Carbon Paper - Turla' report. These services are associated with the Turla APT group's second-stage backdoor, indicating potential privilege escalation and persistence mechanisms.
Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.
Detects the creation of a Windows service by the ProcessHacker tool, specifically when the service is configured to run with 'LocalSystem' privileges and its name starts with 'ProcessHacker'. This indicates a potential privilege escalation attempt using ProcessHacker.
This rule detects the creation of a service named 'WerFaultSvc' with EventID 7045 from the 'Service Control Manager' provider, which is associated with the Turla PNG dropper as reported by NCC Group in November 2018. This indicates potential persistence or privilege escalation by the Turla APT group.
Detects the execution of the hacktool SharPersist, which is used to deploy various persistence mechanisms on Windows systems. The rule specifically identifies SharPersist.exe being executed with command-line arguments indicative of creating scheduled tasks, modifying startup folders, adding registry run keys, or installing new services for persistence.
Detects the creation or modification of Windows services in the registry that exhibit patterns commonly associated with Cobalt Strike beacons for persistence, privilege escalation, or lateral movement. Specifically, it looks for registry modifications to service control sets containing 'ADMIN$' and '.exe' or '%COMSPEC%', 'start', and 'powershell' in the service details, indicating a potential malicious service installation.
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable.
Detects suspicious modifications to a Windows service's Discretionary Access Control List (DACL) using 'sc.exe' to deny access to critical trustees. This technique can be used by adversaries to hide services, make them unstoppable, or achieve persistence and privilege escalation by preventing legitimate users or administrators from managing the service.
Detects the modification of an existing service's configuration (binpath or failure command) using 'sc.exe' or 'reg.exe' to execute an arbitrary payload. This is a common method for establishing persistence or escalating privileges by ensuring a malicious executable runs when the service starts or fails.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee using 'sc.exe sdset'. This technique can be used by adversaries for privilege escalation or persistence by overriding existing access restrictions on Windows services.
Page 31 of 41