Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
16
10
3
2
1
Contributors
7
6
6
5
5
Categories
14
5
5
3
3
Platforms
28
5
2
1
1
Products / Services
8
7
6
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
3
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of processes containing command-line arguments '-debugport' or '-lport'. These flags are often used to configure remote debugging or listen ports, which can be abused by adversaries for persistence or command and control (C2) communication.
Detects attempts to exploit the SystemInformer (formerly Process Hacker) service (phsvc) for local privilege escalation. The rule monitors for abnormal process spawning by rundll32.exe, the presence of specific PoC artifacts like 'phsvc_rundll_poc.dll', 'systeminformer_phsvc_poc.txt', or command-line arguments containing 'SYSTEMINFORMER_PHSVC_POC', and loading of DLLs from user-writable temporary directories.
This rule detects the execution of ConfigurationRemotingServer.exe when spawned by unexpected parent processes, such as winget.exe, WindowsPackageManagerServer.exe, or DSCourier.exe. These processes are associated with Desired State Configuration (DSC) and package management, and their use to launch ConfigurationRemotingServer.exe in certain contexts may indicate exploitation of DSC features to execute unauthorized configurations or commands.
Detects instances where a Node.js or NPM process spawns the systemd-userdbd utility. This behavior is highly irregular in standard Linux environments and may indicate an attempt to interact with system user databases, potentially for privilege escalation, persistence, or credential discovery by an application running in the Node.js runtime.
This rule detects instances where a Node.js process spawns or executes the systemd-userdbd utility. systemd-userdbd is a system daemon used for user/group database lookups. Execution of this component by a user-land Node.js application is highly atypical and may indicate a compromise where an attacker is abusing system binaries for persistence, privilege escalation, or reconnaissance.
This rule monitors for suspicious activities related to System Informer (formerly Process Hacker) and its associated service (phsvc.exe). It detects unauthorized or unusual execution patterns, such as unsigned client binaries, shell spawning, or the use of specific proof-of-concept (PoC) command-line arguments that indicate attempts to abuse the service's privileged capabilities for process management or evasion.
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
This rule detects attempts to execute remote services over SMB, specifically looking for traffic on port 445 containing both the SMB signature and the 'Service Control' string. This combination suggests an attempt to interact with or manipulate services on a remote system via SMB, which is a common technique used by attackers for lateral movement or privilege escalation.
Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy. Option mode "-m" will not report any service installation, only service failures.
Detects scenarios where an attacker uses the Tchopper tool by remotely creating multiple services via named pipes.
Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. Service name may come with very high entropy.
Detects scenarios where an attacker attempts to escalate privileges while abusing KrbRelayUp attack.
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Page 1 of 2