Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
401 detections
Filters
Last updated
All Time
Detection languages
194
103
41
21
13
Contributors
106
64
60
37
30
Categories
195
194
151
46
31
Platforms
395
6
4
1
1
Products / Services
140
106
95
57
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
IDS Classtypes
2
1
1
IDS Protocols
1
1
Detects the creation of the default PsExec service executable file, 'PSEXESVC.exe', which is indicative of PsExec being used to install and execute a service on a system.
This rule detects instances where 'rundll32.exe' is executed without any command-line parameters. This behavior has been observed in the context of Metasploit's windows/smb/psexec exploit module, where rundll32.exe is used to proxy execution of malicious code. Legitimate uses of rundll32.exe typically involve specific DLL and function arguments.
This rule detects the creation of a new Windows service (EventID 7045 from 'Service Control Manager') where the service's ImagePath contains specific PowerShell commands indicative of Invoke-Obfuscation's COMPRESS obfuscation technique. Specifically, it looks for the presence of 'new-object', 'text.encoding]::ascii', 'readtoend', and either ':system.io.compression.deflatestream' or 'system.io.streamreader' within the ImagePath. This combination suggests an attempt to decompress and execute obfuscated PowerShell code as part of a service.
Detects the creation of a new service where the ImagePath contains 'rundll32' and 'shell32.dll' along with obfuscation indicators like '&&', 'value', 'invoke', 'comspec', or 'iex'. This pattern is often used by adversaries to execute obfuscated PowerShell commands via rundll32, specifically leveraging 'shellexec_rundll'.
Detects the execution of PsExec's service component (psexesvc.exe) when it has been renamed. This often indicates an attempt to evade detection by security tools that monitor for the default service name, as legitimate administrators typically use the original name.
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Detects the execution of 'csexec.exe', a remote execution tool similar to PsExec. This tool can be used by attackers for lateral movement or remote code execution within a network.
Detects the creation of a named pipe with the default name '\csexecsvc', which is commonly used by CSExec for remote command execution. This activity is indicative of potential lateral movement or execution of unauthorized code.
Detects the execution of NirCmd, a legitimate command-line utility, when used with specific command-line arguments that indicate execution of other commands or scripts. This could be indicative of an adversary using NirCmd for execution, potentially to hide windows or run commands with specific privileges.
This rule detects the use of the 'sc.exe' utility to modify service DACLs (Discretionary Access Control Lists) by adding specific permissions ('DCLCWPDTSD'). This technique is often used by threat actors to hide services, making them unremovable and persistent, thereby achieving defense evasion, persistence, and privilege escalation.
This rule detects suspicious command-line flag combinations often used by tools like PsExec to execute commands with elevated privileges, specifically targeting 'system' or 'administrator' accounts. It looks for the presence of user-setting flags ('-u system', '--user system', '-u NT', etc.) combined with command execution flags ('-c cmd', '-c powershell', '-c whoami', etc.). This pattern is indicative of an attempt to escalate privileges or execute commands as a highly privileged user.
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Detects the creation of a named pipe with a name starting with '\PAExec', which is the default named pipe used by the PAExec utility. This can indicate remote execution activity using PAExec.
Detects the usage of the "net.exe" or "net1.exe" command-line utility to start a Windows service using the "start" flag. This activity can be indicative of an adversary executing a service, potentially for persistence or privilege escalation.
This rule detects the execution of NirCmd with the 'runassystem' command-line argument. NirCmd is a legitimate command-line utility that can be used to perform various tasks, including running commands as the SYSTEM user. Adversaries may abuse this functionality to execute arbitrary commands with elevated privileges, potentially for privilege escalation or to maintain persistence. The detection specifically looks for the ' runassystem ' string in the command line, indicating an attempt to execute a process with SYSTEM privileges using NirCmd.
Detects the use of the 'sc.exe' utility to change the startup type of a Windows service to 'disabled' or 'demand'. This action can be used by adversaries to impair defenses or prevent legitimate services from starting.
Detects the execution of the RunXCmd tool when it attempts to run commands with elevated privileges, specifically using the 'System' or 'TrustedInstaller' accounts. This tool is often used for privilege escalation.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects RemCom service installation and execution events
Detects well-known credential dumping tools execution via service execution events
Detects powershell script installed as a Service
Page 18 of 20