Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the installation or execution of services associated with known hack tools or UAC bypass techniques. The rule specifically looks for Windows Service Control Manager events (7045 for service installation, 7036 for service state changes) in conjunction with service names or image paths that are indicative of tools like cachedump, gsecdump, pwdump, PsExec, or UAC bypass mechanisms.
Detects the installation of the 'RTCore64' service, which is associated with Micro-Star MSI Afterburner. This service can be abused by attackers to load vulnerable drivers, a technique often referred to as 'Bring Your Own Vulnerable Driver' (BYOVD) for privilege escalation or defense evasion.
Detects various Windows Update errors, including failures to connect to the update service, installation failures, uninstallation failures, revert failures, and commit failures. Monitoring these events is crucial to ensure that critical security updates are being successfully applied to systems. Persistent errors could indicate issues with network connectivity, compromised update services, or attempts to prevent system patching, which could leave systems vulnerable to known exploits.
Detects the installation of a service by the smbexec.py tool, identified by a specific service name ('BTOBTO') and characteristic command-line arguments in the ImagePath, which typically involve executing a batch script and redirecting output.
Detects the creation of a service named 'ZzNetSvc' which is associated with the Moriya rootkit, as described in the 'Operation TunnelSnake' report by Securelist. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation.
Detects the installation of the NetSupport Manager client service on a Windows system. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service paths containing '\NetSupport Manager\client32.exe' or a service name of 'Client32'. This activity can be indicative of legitimate remote administration tool deployment or malicious use for persistence.
Detects the creation of a Windows service named 'GoogleUpdate' with a specific ImagePath containing 'rundll32', 'FileProtocolHandler', and '\ProgramData\GoogleUpdate\GoogleUpdate.exe'. This pattern is associated with the Goofy Guineapig backdoor for persistence.
This rule detects the creation of scheduled tasks by monitoring specific registry key paths associated with the Windows Task Scheduler. Adversaries often use scheduled tasks for persistence, privilege escalation, or execution of malicious code. By observing modifications to these registry paths, the rule aims to identify when new scheduled tasks are being registered on a system.
This rule detects the mounting of a volume shadow copy, specifically looking for Event ID 98 from the Microsoft-Windows-Ntfs provider where the DeviceName contains 'HarddiskVolumeShadowCopy'. Adversaries may mount volume shadow copies to access files, including credential stores like the Security Account Manager (SAM) database, without directly interacting with the live file system, which can bypass some security controls.
Detects when the 'Windows Defender Threat Protection' service is disabled or stopped. This event is triggered when the service state changes to stopped, which could indicate an attempt to impair defenses.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects the creation of a new Windows service where the ImagePath contains either 'Clipboard' or 'i', which could indicate an attempt to obfuscate PowerShell commands using techniques like Invoke-Obfuscation. This rule specifically looks for EventID 7045 from the 'Service Control Manager' provider.
Detects suspicious service installations by monitoring Event ID 7045 from the Service Control Manager. The rule looks for specific command-line patterns in the ImagePath field that are commonly associated with malicious service creation, such as PowerShell download commands, hidden windows, or execution from temporary directories.
Detects Windows services that terminate with an error, which can indicate issues with the service itself, or malicious activity attempting to disrupt or disable services. This rule specifically looks for Event ID 7023 from the 'Service Control Manager' provider.
Detects various obfuscated PowerShell IEX invocation patterns generated by the Invoke-Obfuscation framework. The rule specifically looks for regex patterns in the ImagePath field of Event ID 7045 (Service Creation) that are characteristic of Invoke-Obfuscation's techniques to hide PowerShell commands.
This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.
Detects the installation and execution of the RemCom service, which is often used for remote administration and can be leveraged by adversaries for lateral movement or persistence.
Detects the unexpected termination of important Windows services, specifically targeting 'Message Queuing' (MSMQ) service. This could indicate an attempt to disrupt critical system functions or evade detection by stopping services that might be monitoring activity or providing essential communication channels.
Detects the installation of a new Windows service where the service executable's image path contains suspicious locations such as 'AppData' directories or remote IP addresses like '127.0.0.1' or 'localhost'. This can indicate an attempt at persistence or privilege escalation by adversaries installing malicious services in non-standard locations.
Detects the creation of new Windows services with specific names ('Name', 'msupdate', 'msupdate2') and an ImagePath containing '\Windows\System32\svchost.exe'. This pattern is associated with the COLDSTEEL RAT for persistence.
Detects obfuscated use of standard input (STDIN) to execute PowerShell commands, often associated with techniques like Invoke-Obfuscation. The rule looks for the creation of a service (EventID 7045) where the ImagePath contains 'cmd' and 'powershell', along with command-line arguments indicating execution ('/c' or '/r') and either 'noexit' or the '$input' variable, which are common patterns for executing PowerShell from STDIN.
Page 55 of 61