Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Detects a copy command or a copy utility execution to or from an Admin share or remote
Detects the installation of a PDQDeploy service on a target system. When a package is deployed via PDQDeploy, it installs a remote service named "PDQDeployRunner-X" (where X is an integer) on the target machine.
Detects the installation of a Windows service by the Sliver C2 framework. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, combined with an ImagePath characteristic of Sliver (an executable in the Windows temporary directory with a 10-character alphanumeric name) or a ServiceName explicitly identifying as 'Sliver' or 'Sliver implant'. This behavior is often observed when Sliver implants use tools like PsExec to establish persistence.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects post-exploitation execution technique of the Serpent backdoor. This involves creating a temporary scheduled task using an unusual method: creating a fictitious Windows event and a trigger that executes a payload once the event is created. The detection specifically looks for command-line arguments indicative of this behavior when executed by cmd.exe or powershell.exe.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472, also known as Zerologon. This vulnerability allows an unauthenticated attacker to gain domain administrator privileges.
Detects the installation of a PDQDeploy service on a machine. PDQDeploy is a legitimate system management tool that can be leveraged by attackers to remotely install packages or execute commands on target machines, leading to persistence or privilege escalation.
Detects the creation of a new Windows service where the creating process has a Process ID (PID) of 0 or its parent process has a PID of 0. This is an unusual and suspicious behavior, as PID 0 is typically reserved for the System Idle Process or the System process itself, which should not be directly creating services. This could indicate a highly privileged process or kernel-level activity attempting to establish persistence or escalate privileges.
Detects the creation of new Windows services that exhibit characteristics commonly associated with Cobalt Strike beacon activity, specifically focusing on suspicious ImagePath values. This includes services created with paths pointing to ADMIN$ shares, PowerShell commands for execution, or encoded PowerShell commands often used for downloading and executing payloads.
Detects the installation of a new service by Meterpreter or Cobalt Strike's 'getsystem' command. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, combined with command-line patterns indicative of Meterpreter/Cobalt Strike's techniques for privilege escalation, such as using 'echo' to a named pipe, 'rundll32' with specific arguments, or creating a service from a local administrative share.
This rule detects the installation or start of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools to maintain persistence, escalate privileges, or establish command and control over compromised systems. The rule specifically looks for Event IDs 7045 (Service Installation) and 7036 (Service Started) from the 'Service Control Manager' provider, where the service name contains keywords indicative of known remote access software such as AmmyyAdmin, TeamViewer, LogMeIn, and others.
Detects the creation of a Windows service named 'KrbSCM' which is associated with the KrbRelayUp tool. This tool is used for privilege escalation in Windows domain environments where LDAP signing is not enforced, leveraging Kerberos relay attacks.
This rule detects the creation of specific Windows services ('srservice', 'ipvpn', 'hkmsvc') that have been identified as malicious by ESET in their 'Carbon Paper - Turla' report. These services are associated with the Turla APT group's second-stage backdoor, indicating potential privilege escalation and persistence mechanisms.
Detects the creation of specific Windows services ('SC Scheduled Scan' or 'UpdatMachine') that have been associated with the OilRig APT group for persistence, as reported by Nyotron in their March 2018 report. This rule monitors EventID 7045 from the 'Service Control Manager' provider.
Detects the creation of a Windows service by the ProcessHacker tool, specifically when the service is configured to run with 'LocalSystem' privileges and its name starts with 'ProcessHacker'. This indicates a potential privilege escalation attempt using ProcessHacker.
This rule detects the creation of a service named 'WerFaultSvc' with EventID 7045 from the 'Service Control Manager' provider, which is associated with the Turla PNG dropper as reported by NCC Group in November 2018. This indicates potential persistence or privilege escalation by the Turla APT group.
Page 41 of 61