Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the creation of new Windows services with specific names ('Name', 'msupdate', 'msupdate2') and an ImagePath containing '\Windows\System32\svchost.exe'. This pattern is associated with the COLDSTEEL RAT for persistence.
This rule detects the installation of the 'Remote Utilities - Host' service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation. The detection is further refined by checking for the presence of 'rutserv.exe' and '-service' in the ImagePath, or the exact service name 'Remote Utilities - Host'. This activity is often associated with remote access tools, which can be used legitimately for IT administration but also by adversaries for persistence and remote control.
This rule detects the creation of new Windows services with suspicious or uncommon image paths. It specifically looks for paths containing references to named pipes, common temporary directories like `Users\Public\` or `Windows\Temp\`, or image paths that include patterns indicative of encoded PowerShell commands (e.g., `-e` followed by specific base64 encoded strings). This behavior is often associated with adversaries establishing persistence or escalating privileges by creating malicious services.
Detects the installation of a new Windows service where the executable path contains suspicious patterns, specifically executables located directly under 'ProgramData' or the root of the C: drive with a short, potentially obfuscated name (e.g., 'C:\ProgramData\.{1,9}\.exe' or 'C:\.{1,9}\.exe'). This pattern is often used by malware for persistence and to evade detection by hiding in less common locations.
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Detects the creation of a Windows service named "WerFaultSvc" with a specific ImagePath pattern, which has been identified as a persistence mechanism used by the SNAKE malware (also known as EKANS) as described in CISA reports. The rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, where the service name contains 'WerFaultSvc' and the ImagePath starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe'.
Detects the creation of the LiveKD driver file (LiveKdD.SYS) by the LiveKD or LiveK64 executables. LiveKD is a tool used for live kernel debugging, which can be leveraged by adversaries for defense evasion or privilege escalation by interacting directly with the kernel.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the creation of a new Windows service using PowerShell cmdlets, specifically looking for 'New-Service' and '-BinaryPathName' in the command line. This activity can be indicative of persistence mechanisms or privilege escalation attempts by adversaries.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Detects the creation of a new service using powershell.
Detects suspicious service installation commands
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.
Detects service installation in suspicious folder appdata
Detects service installation with suspicious folder patterns
Detects a driver load from a temporary directory
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Yara rule that detects WhiteBlackCrypt ransomware.
Yara rule that detects HakunaMatata ransomware.
Page 40 of 41