Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
401 detections
Filters
Last updated
All Time
Detection languages
194
103
41
21
13
Contributors
106
64
60
37
30
Categories
195
194
151
46
31
Platforms
395
6
4
1
1
Products / Services
140
106
95
57
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
IDS Classtypes
2
1
1
IDS Protocols
1
1
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects the creation of a Windows service using the 'sc.exe' utility where the service executable is located in a potentially untrusted directory such as Temp, AppData, ProgramData, Users\Public, or Downloads. This behavior is frequently used by adversaries to establish persistence or execute malicious code with elevated privileges.
Detects the creation or modification of a Windows service named 'MixedSvc' or containing 'Mixed Reality' in the command line where the binPath points to a non-System32 directory or the Windows Media Player folder, which is indicative of potential service hijacking or persistence techniques.
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects malicious use of PowerShell cmdlets to modify Group Policy Objects (GPOs) for ransomware distribution. The rule monitors for execution of GPO management cmdlets in conjunction with specific ransomware indicators, such as disabling Windows Defender real-time monitoring, modifying GPO machine extension names, or targeting SYSVOL/NETLOGON network shares.
Detects the creation of Windows services where the executable path is located in suspicious or volatile directories such as ProgramData, Temp, or AppData. This behavior is indicative of malware, specifically the The Gentlemen RaaS group, establishing persistence or deploying malicious components on a compromised system.
Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or start a service on a remote host, identified by the presence of UNC paths (\\) and service management commands (create, start) in the command line.
This rule detects the execution of common remote administration tools (PsExec, PaExec, RemCom) specifically on devices identified as domain controllers based on their naming convention.
Detects the ConfigurationRemotingServer.exe process spawning the Windows Service Control Manager (sc.exe). This pattern is often associated with the manipulation of Windows services, which can be an indicator of service-based persistence or command execution.
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
Detects JFMBackdoor activity where a sideloaded fltMC.exe executable located in a temporary directory initiates process enumeration using tasklist.exe or performs service lifecycle management operations (delete, start, stop, create, or query) using the sc.exe utility.
Detects the execution of sc.exe with subcommands 'create' or 'start' where the command line includes a UNC path. This pattern is indicative of an adversary attempting to install or execute a service on a remote host to facilitate lateral movement.
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
Detects the creation, deletion, or starting of a Windows service named 'MixedSvc' via sc.exe. This activity is associated with the 'Operation DragonReturn' campaign, where adversaries leverage a service masquerading as legitimate Windows Media Player components to maintain persistence.
Detects the use of the Windows Service Control Manager (sc.exe) to create, start, or delete a service named 'MixedSvc'. The rule includes specific checks for binPath configurations, which can be indicative of persistence or privilege escalation attempts using services.
Detects attempts to stop or modify critical Windows security services (Windows Defender, Security Center, Security Health Service) using the Service Control utility (sc.exe). This activity is often indicative of an adversary attempting to impair defenses.
Detects evidence of common Impacket tool execution (e.g., psexec, wmiexec, smbexec, ntlmrelayx), unauthorized access to sensitive SMB administrative shares (ADMIN$, IPC$), creation of suspicious services often used for remote execution, and lateral movement via NTLM network logons.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Page 6 of 20