Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
This query looks for signs of impacket psexec module usage. May hit other psexec-like techniques too.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-psexec/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-psexec/
Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes
Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.
Detects creation of a new service (kernel driver) with the type "kernel"
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable
Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
Detects service installation in suspicious folder appdata
Detects rare service installs that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious services
New Service Creation
Sigma
Detects creation of a new service.
Detects a driver load from a temporary directory
Detects loading of known malicious drivers via the file name of the drivers.
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
MosaicLoader
KQL
This hunting query looks Malware Hides Itself Among Windows Defender Exclusions to Evade Detection
Page 36 of 41