Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the creation of a new kernel driver service using 'sc.exe'. This activity can be indicative of persistence or privilege escalation attempts by adversaries, as kernel drivers operate with high privileges. The rule specifically looks for 'sc.exe' commands that include 'create' or 'config' along with 'binPath', 'type', and 'kernel' parameters. It includes filters for known legitimate Avira driver installations to reduce false positives.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Detects creation of a new service (kernel driver) with the type "kernel"
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
Detects the creation of a new service using the "sc.exe" utility. This activity can be used by adversaries for persistence or privilege escalation by creating a malicious service that executes at system startup or with elevated privileges.
This KQL query analyzes driver load events on Windows endpoints to detect malicious activity. It specifically looks for drivers (.sys files) being loaded from non-standard, user-writable directories.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
Detects the creation of a new service using the "sc.exe" utility.
Detects scenarios where an attacker attempts to create a service for persistence.
Detects scenarios where an attacker modify the original service executable path with a malicious one.
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Detects TTPs associated with a Lazarus subgroup using the SessionEnv service for persistence and privilege escalation. This involves phantom DLL loading, service auto-start configuration, and registry modification for elevated privileges.
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence.
This rule detects activity related to 'SMOKEDHAM backdoor' which manipulate the default running service accounf of the MSDTC service in order to DLL side-load a malicious binary.
Detects the PerfhLoader persistence technique used by the Lazarus Group, which involves modifying the 'SessionEnv' service to start automatically and either adding sensitive privileges or dropping a malicious DLL for phantom loading. This rule correlates events across process launches (sc.exe modifying SessionEnv service), registry modifications (adding privileges to SessionEnv service), and file creations (dropping a specific DLL for phantom loading).
Detects the creation of a new Windows service configured to start automatically from a suspicious file path. This behavior is indicative of persistence mechanisms used by malware like the Tinky Winkey keylogger.
Detects scenarios where an attacker modify the original service executable path with a malicious one.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
Page 33 of 41