Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
4
1
1
Contributors
3
2
1
Categories
3
1
1
1
1
Platforms
5
1
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects replacement of service binaries for execution flow hijacking
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
Detects scenarios where an attacker modify the original service executable path with a malicious one.
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges
Search for dropping of files to Windows/Program Files fodlers by non-priviledged processes
