Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
401 detections
Filters
Last updated
All Time
Detection languages
194
103
41
21
13
Contributors
106
64
60
37
30
Categories
195
194
151
46
31
Platforms
395
6
4
1
1
Products / Services
140
106
95
57
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
IDS Classtypes
2
1
1
IDS Protocols
1
1
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects suspicious service installation patterns involving WmiPrvSE, common in lateral movement techniques.
Detects remote service creation consistent with PsExec-style lateral movement by correlating network logons (Type 3) with subsequent service installations.
Detects remote service creation consistent with PsExec-style lateral movement by correlating network logons (Type 3) with subsequent service installations.
Detects remote service creation consistent with PsExec-style lateral movement by correlating network logons (Type 3) with subsequent service installations.
Detects the execution of known potentially malicious tools cplsupport.exe and wtass.exe with install parameters, or the creation of a Windows service associated with these filenames using sc.exe. This activity is indicative of service-based persistence or malicious software installation.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects attempts to modify or disable the Windows Update service (wuauserv) using command-line utilities (sc.exe, cmd.exe, powershell.exe) in a context involving 'LockAppHost.exe'. This pattern is often associated with unauthorized attempts to tamper with security update mechanisms to prevent system patching.
Detects the execution of known potentially malicious tools cplsupport.exe and wtass.exe with install parameters, or the creation of a Windows service associated with these filenames using sc.exe. This activity is indicative of service-based persistence or malicious software installation.
Detects the execution of known potentially malicious tools cplsupport.exe and wtass.exe with install parameters, or the creation of a Windows service associated with these filenames using sc.exe. This activity is indicative of service-based persistence or malicious software installation.
Detects the installation or creation of a Windows service related to RustDesk, a remote access software application. This may indicate unauthorized installation or persistence setup of remote control tools by an adversary.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
Detects local Administrators group enumeration via net.exe or net1.exe within 10 minutes of a PsExec session on the same device. This behavior is indicative of post-compromise privilege or account discovery following remote service execution.
Detects the execution of PsExec.exe in correlation with the installation of the PSEXESVC service on the same host within a 15-minute timeframe. The rule includes an allowlist filter for authorized administrative accounts to minimize alerts for legitimate infrastructure management.
Detects the installation of the srt64.sys kernel driver, associated with the Daxin rootkit. The detection monitors for the creation of this specific file within the System32\drivers directory and the creation of services referencing the driver file.
Detects the execution of the PsExec service (psexesvc.exe) which is commonly used for remote command execution and lateral movement. This rule monitors for process creation events where psexesvc.exe is spawned by services.exe or wininit.exe, indicative of a remote service installation typically associated with administrative or adversary activity.
Detects the execution of the PsExec service component (psexesvc.exe), which is often used for remote command execution and lateral movement. The rule monitors for the process starting, particularly when it originates from legitimate Windows service management processes like services.exe or wininit.exe.
Detects the creation of a new Windows service where the service binPath points to 'anydesk.exe', optionally accompanied by a system reboot command within one hour of the service creation. This behavior is often associated with the installation or persistent configuration of remote access software.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Detects instances where the FortiClient scheduler executable (scheduler.exe) spawns FortiTray.exe as a child process. While typically a legitimate operational behavior for the FortiClient application, this pattern is monitored to identify potential abuse where a trusted binary is leveraged as a proxy to execute secondary processes.
Page 4 of 20