Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the creation of scheduled tasks using schtasks.exe with command-line arguments that contain suspicious file names, paths, or flags often associated with malicious behavior, such as persistence mechanisms or potential lateral movement tools.
Detects the creation or starting of a Windows service on a remote host using the Service Control Manager (sc.exe) utility. This is a common method for lateral movement and remote execution of malicious payloads.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects the creation or modification of Windows services using sc.exe where the binary path (binpath) points to suspicious or user-writable directories such as User profiles, AppData, Temp, or Public folders, which are often used by adversaries for persistence or privilege escalation.
Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.
This rule detects the use of the Windows Service Control Manager (sc.exe) to create or start a service on a remote host, identified by the presence of UNC paths (\\) and service management commands (create, start) in the command line.
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.
Detects instances where Windows event logs are cleared using built-in utilities (wevtutil.exe) or PowerShell (Get-EventLog/Get-WinEvent, Clear-EventLog) shortly after those same logs were queried or enumerated by the same user on the same device. This pattern is highly indicative of an adversary attempting to conceal malicious activity.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
Hunting rule loosely based off of Atomic Red Team T1112 test "Modify registry to store logon credentials". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely based off of Atomic Red Team T1112 test "Modify registry to store logon credentials". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows LogOff Button". Correlate before alerting on.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows LogOff Button". Correlate before alerting on.
This rule detects potentially malicious lateral movement or persistence activities by monitoring the creation or modification of executable files in remote network shares and startup folders, as well as the use of administrative tools like sc.exe or schtasks.exe to create services or tasks. The rule specifically filters out processes signed by Microsoft, focusing on non-standard or unsigned binaries that perform these administrative actions across multiple instances, indicating potential automated lateral propagation.
Detects the installation of a Windows service associated with the TrymeLocker ransomware strain. The rule monitors System and Security event logs for specific service names ('rageservice') or file paths ('win_guard_', 'ragecore_') indicative of this malware's persistence mechanism.
Detects the Windows Update Service (wusvc.exe) loading advapi32.dll or performing suspicious API calls like GetProcAddress to resolve GetUserNameA. This behavior is atypical for the legitimate Windows Update service and may indicate process injection, credential harvesting, or tampering attempts.
Detects the creation of new Windows services that masquerade as or use names associated with the Windows Update Service (wusvc), specifically looking for service binaries located in suspicious paths or containing 'wusvc.exe' in the name. This pattern often indicates an adversary attempting to establish persistence or masquerade malicious processes as legitimate system services.
Detects indicators of the SNOWLIGHT dropper establishing persistence by either creating a malicious Windows service named 'wusvc', modifying the Windows registry to add a service entry for 'wusvc', or executing a 'wusvc.exe' binary from a non-standard file path (outside of System32 or SysWOW64).
Detects the SNOWLIGHT dropper creating a malicious Windows Service masquerading as the legitimate 'Windows Update Service' (wusvc), followed by outbound TLS network connections to non-Microsoft infrastructure within a 2-minute window. This behavior is indicative of C2 communication from a compromised system.
Page 30 of 61