Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
770 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,443
11,831
5,875
5,151
4,864
770
Platforms
711
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
328
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
This rule detects the use of the `sc.exe` utility to modify the security descriptor of a Windows service. Specifically, it looks for the `sdset` command-line argument, which can be used to grant special permissions to a service, potentially allowing it to be hidden or manipulated for persistence and defense evasion. This technique can be used by adversaries to maintain access and avoid detection by making services less visible to standard enumeration tools.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the creation of a new Windows service using PowerShell cmdlets, specifically looking for 'New-Service' and '-BinaryPathName' in the command line. This activity can be indicative of persistence mechanisms or privilege escalation attempts by adversaries.
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Detects modifications to Windows service paths using the 'sc.exe' utility to point to suspicious executables or common adversary-used paths. This activity can indicate an attempt to establish persistence or escalate privileges by altering how a service executes.
Detects the installation of 'NalDrv' or 'PROCEXP152' services by monitoring registry key modifications. These services are associated with the 'Ghost-In-The-Logs' tool, which leverages KDU for defense evasion. The rule specifically looks for the creation of these service ImagePath registry values in non-system32 folders, filtering out legitimate instances of tools like procexp and procmon.
Detects RemCom service installation and execution events
Detects well-known credential dumping tools execution via service execution events
Detects powershell script installed as a Service
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Detects NetSupport Manager service installation on the target system.
Detects PAExec service installation
Rule to detect the Hybrid Connection Manager service installation.
Detects the use of smbexec.py tool by detecting a specific service installation
Detects well-known credential dumping tools execution via service execution events
Detects powershell script installed as a Service
Detects CSExec service installation and execution events
Detects installation or execution of services
Detects Remote Utilities Host service installation on the target system.
Detects suspicious service installation commands
Page 36 of 37