Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
401 detections
Filters
Last updated
All Time
Detection languages
194
103
41
21
13
Contributors
106
64
60
37
30
Categories
195
194
151
46
31
Platforms
395
6
4
1
1
Products / Services
140
106
95
57
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
IDS Classtypes
2
1
1
IDS Protocols
1
1
Detects anomalous activities associated with the CitrixBleed2 campaign where the ScreenConnect remote access tool is used to deploy or execute QEMU virtual machine artifacts. The rule monitors for the spawning of virtualization binaries (e.g., qemu-system-x86_64) via the ScreenConnect service, the dropping of QEMU-related files into ScreenConnect directories, and the suspicious creation of local administrator accounts (CtxAppVCOMService).
This rule detects the use of 'sc.exe' to interact with services related to 'Mixed Reality' (a potential name masquerading technique) where the parent process is not the standard 'services.exe' or 'svchost.exe'. The rule also correlates this activity with the invocation of command interpreters like 'cmd.exe' or 'conhost.exe' by the parent process, which is highly indicative of malicious service manipulation or lateral movement.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
This rule detects the installation or modification of kernel-mode drivers on Windows systems. It identifies potential driver installation activities using 'sc.exe' to create a service with a kernel-type driver image, or by monitoring Registry 'ImagePath' updates for services that point to '.sys' files, a common method for rootkit or malicious driver persistence.
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
This rule monitors for the execution of common remote access and support tools (AnyDesk, TeamViewer, ScreenConnect, QuickAssist) that originate from suspicious file paths (e.g., Temp, AppData, Downloads) or are launched with silent installation flags, or appear to be installed via msiexec by non-standard parent processes. These behaviors are common indicators of adversaries attempting to establish unauthorized persistent remote access or deploying remote support tools as part of a post-exploitation activity.
Detects the creation or modification of Windows kernel-mode services using the sc.exe utility when the process is not initiated by the legitimate service control manager (services.exe). This behavior is often associated with the loading of malicious drivers or rootkits, which may attempt to bypass standard service management processes to maintain persistence or elevate privileges.
Detects the creation or configuration of Windows services spawned by WinGet-related processes such as ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is often associated with software installation or configuration management but could be abused by adversaries to establish persistence or execute code with elevated privileges.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
This rule detects the execution of common remote administration tools (PsExec, PaExec, RemCom) specifically on devices identified as domain controllers based on their naming convention.
Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.
Detects the installation of a new Windows service using sc.exe from a non-standard parent process (not services.exe) or the installation of a service with an executable path located in suspicious directories such as Temp, AppData, ProgramData, or Users folders.
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
Detects the creation of new Windows services through suspicious or unexpected process chains. This includes services spawned by WinGet/DSC components, services created by sc.exe where the process path points to user-writable directories (e.g., Temp, AppData, User profiles), or system event logs (Event ID 7045) indicating service installation from non-standard locations. This rule is designed to identify potential persistence mechanisms or privilege escalation attempts involving unauthorized service creation.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe).
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.
This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.
Detects execution of the RustDesk remote access tool from non-standard, user-writable directories, or when spawned by suspicious parent processes such as shells or scripting hosts. This rule is designed to identify unauthorized use of RustDesk as a persistence or remote access mechanism by adversaries attempting to bypass standard software management.
This rule detects lateral movement activity and implant deployment patterns associated with the threat group OceanLotus (APT32). It monitors for the creation of specific suspicious files and paths often used by SPECTRALVIPER/WINDSHIELD malware, identifies file transfers over SMB orchestrated by system processes, tracks the execution of remote administration tools like PsExec, and identifies internal pivot activity via named pipes.
Page 5 of 20