Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the creation or modification of a Windows service to belong to a high-priority service group.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (A service was installed in the system). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
Detects the creation of a Windows service named "NSecRTS" with the display name "Windows Real-time Protection Service" and an executable path in a suspicious "NSEC" folder. This behavior is associated with a China-linked RAT observed in an Indian Income Tax-themed phishing campaign.
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Detects the installation of the Velociraptor agent as a Windows service, a technique used by threat actors for persistence and command and control (C2).
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.
Detects attempts to query system information directly from the Windows Registry.
Detects a suspicious child process of Script Event Consumer (scrcons.exe).
Detects attempts to stop critical services like Veeam and MSSQL, a behavior associated with Cephalus ransomware to ensure successful encryption and hinder recovery.
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Detects the stopping of a Windows service via the "sc.exe" utility
Detects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
Detects the use of NirCmd tool for command execution as SYSTEM user
Detects the export of the target Registry key to a file.
Detects suspicious print spool service (spoolsv.exe) child processes.
Detects modification of autostart extensibility point (ASEP) in registry.
Page 40 of 61