Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.
detects creation of QoS throttle policies in HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\ with ThrottleRate value. pacer.sys enforces these policies at the NDIS layer below WFP, throttling EDR agent bandwidth to near-zero and causing telemetry upload timeouts.
This rule detects activities characteristic of the 'Gentleman' ransomware, including the creation of a specific ransom note file ('README-GENTLEMAN.txt'), attempts to tamper with Windows Defender security preferences, and the destruction of system recovery artifacts such as Volume Shadow Copies and various system logs/prefetch files.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Detects when the Secure Boot Advanced Targeting (SBAT) registry policy on Windows systems is either missing or contains outdated revocation entries (lacking 'shim,4' and 'grub,5'). This indicates the boot chain may be using vulnerable bootloader components susceptible to known security bypasses, as the system is not properly enforcing updated revocation generation policies.
Detects the execution of the Windows shutdown utility with arguments to force an immediate system reboot. This behavior is commonly observed during the final stages of ransomware attacks, such as NoEscape, to force the system into a state where encrypted files are finalized or to disrupt user access.
Detects a process that simultaneously loads 'RstrtMgr.dll' and modifies the 'WaitToKillServiceTimeout' registry value within a 2-minute window. This behavior is indicative of an adversary attempting to force system service restarts or accelerate service termination, often seen as part of persistence mechanisms or defensive impairment.
This rule monitors for suspicious activity aimed at disabling or tampering with security software, including antivirus processes and services. It identifies execution of tools named 'AVKiller.exe', the usage of commands like 'taskkill', 'net stop', or 'sc stop' against known security-related processes, and the modification of Windows Defender scheduled tasks to disable security scans.
Detects the execution of psexesvc.exe, the service component of the PsExec tool, spawned from services.exe. This activity is indicative of lateral movement through the use of PsExec, which installs and executes the service to run commands remotely.
This rule detects potential persistence mechanisms used by LabubaRAT by monitoring for the creation or modification of the 'NVIDIA Container Runtime Monitor' value within the HKEY_CURRENT_USER Run registry key. It specifically looks for Registry modifications that trigger the execution of 'nvidia-sysruntime.exe' with specific command-line arguments, suggesting an attempt to masquerade as legitimate NVIDIA software for persistence.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Detects the loading of a kernel driver named 'g11.sys', which is associated with the PoisonX campaign, a technique typically used for kernel-level persistence or exploitation.
Detects a specific sequence of commands involving the termination of the AnyDesk process using taskkill, a short delay via the timeout command, and an immediate system reboot. This sequence is often associated with persistence setup or system preparation by threat actors.
This rule detects the creation of a Windows service named 'SecurityHealthIron' using the sc.exe utility or direct service creation calls. This specific naming convention is often associated with suspicious or potentially malicious activity attempting to masquerade as a legitimate Windows Security Health service.
Page 17 of 61