Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
New Service Creation
Sigma
Detects creation of a new service.
This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET
Detects the installation of a service named "javamtsup" on the system.
The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky
Detects service path modification via the "sc" binary to a suspicious command or path
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
Detects the creation of a new service using the "sc.exe" utility.
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.
ServiceDll Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry.
This is often used as a method of persistence.
This is often used as a method of persistence.
Detects PDQDeploy service installation on the target system.
When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1
When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1
Detects suspicious service installation commands
Detects service installation with suspicious folder patterns
Detects a ProcessHacker tool that elevated privileges to a very high level
Detects suspicious service installation scripts
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.
Detects the load of a legitimate signed driver named HW.sys by often used by threat actors or malware for privilege escalation
Detects the load of a signed and vulnerable AVAST Anti Rootkit driver often used by threat actors or malware for stopping and disabling AV and EDR products
Detects loading of known malicious drivers via their hash.
Page 37 of 41