Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
401 detections
Filters
Last updated
All Time
Detection languages
194
103
41
21
13
Contributors
106
64
60
37
30
Categories
195
194
151
46
31
Platforms
395
6
4
1
1
Products / Services
140
106
95
57
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
IDS Classtypes
2
1
1
IDS Protocols
1
1
Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" directory as a service. This behavior has been reported by CISA as indicative of potential SNAKE malware activity.
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.
Detects the installation or execution of services associated with known hack tools or UAC bypass techniques. The rule specifically looks for Windows Service Control Manager events (7045 for service installation, 7036 for service state changes) in conjunction with service names or image paths that are indicative of tools like cachedump, gsecdump, pwdump, PsExec, or UAC bypass mechanisms.
Detects the installation of a service by the smbexec.py tool, identified by a specific service name ('BTOBTO') and characteristic command-line arguments in the ImagePath, which typically involve executing a batch script and redirecting output.
This rule detects the creation of a new Windows service where the service executable path contains 'powershell' or 'pwsh'. This behavior is often indicative of an adversary attempting to establish persistence or elevate privileges by running PowerShell scripts as a service.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.
This rule detects the creation of the PSEXESVC.exe process, which is the service component of PsExec. The presence and execution of this service indicate that PsExec was used to remotely execute commands or applications on the system.
This rule detects the execution of a child process by the PSEXESVC.exe service, specifically when that child process runs with LOCAL_SYSTEM privileges. This indicates that a command was remotely initiated on the system with the highest possible privileges, rather than the privileges of the initiating user account. This behavior is characteristic of PsExec being used for remote execution with SYSTEM-level access.
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
Detects the installation and execution of the RemCom service, which is often used for remote administration and can be leveraged by adversaries for lateral movement or persistence.
This rule detects the execution of specific Windows utilities (`tree.com`, `WMIC.exe`, `doskey.exe`, `sc.exe`) when their output is redirected to a temporary file. This behavior is often associated with adversaries collecting system information or reconnaissance data for later exfiltration or analysis, as indicated by the use of `> %TEMP%\` or `> %TMP%\` in the command line.
Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.
Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.
Detects the installation of a service by PAExec, a remote administration tool. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service names or image paths starting with 'PAExec-'. This is a common indicator of PAExec being used to execute commands or deploy tools remotely.
Detects the creation of a new Windows service where the ImagePath contains highly obfuscated PowerShell commands. Specifically, it looks for 'cmd' executing a 'set' command to define an environment variable, followed by PowerShell execution with the '-f' format operator, which is characteristic of Invoke-Obfuscation's VAR+ launcher technique. This method uses environment variables and string manipulation to hide malicious PowerShell code.
Detects when Microsoft Defender for Endpoint blocks process creations originating from PSExec or WMI commands. This rule specifically looks for Event ID 1121 (Attack Surface Reduction rule blocked action) where the process name ends with 'wmiprvse.exe' (WMI Provider Host) or 'psexesvc.exe' (PsExec service). This indicates that an ASR rule designed to prevent execution via these methods has been triggered and successfully blocked the action.
Detects the creation of the default named pipe for PsExec (PSEXESVC) when the PsExec executable is run from suspicious locations such as temporary directories, public user folders, or common download/desktop locations. This activity can indicate the use of PsExec by an attacker.
Detects the stopping of a Windows service using the built-in 'sc.exe' utility. This rule specifically looks for process creation events where 'sc.exe' is executed with the 'stop' command-line argument. While 'sc.exe' is a legitimate system tool, its use to stop services can be indicative of malicious activity, especially when combined with other suspicious behaviors, as adversaries may stop services to disrupt operations, evade defenses, or facilitate data destruction/encryption.
Detects the creation of the default CSExec service executable file, 'csexecsvc.exe', which indicates the installation and potential execution of the CSExec service. CSExec is a tool similar to PsExec, used for remote command execution.
This rule detects the creation of a file named 'RemComSvc.exe', which is the default service executable name used by the RemCom utility. The presence of this file typically indicates the installation and execution of RemCom on a Windows system, often for remote administration or malicious purposes.
Page 17 of 20