System Services detection rulesT1569

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.

windows

Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

windows

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

windows

Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

windows · process_creation

Detects the use of SharpUp, a tool for local privilege escalation

windows · process_creation

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

windows

Detects well-known credential dumping tools execution via service execution events

windows

Detects well-known credential dumping tools execution via service execution events

windows

Detects installation or execution of services

windows

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

windows

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

windows

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.

windows · registry_set

Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

windows · process_creation

Detects that a powershell code is written to the registry as a service.

windows · registry_set

Detects powershell script installed as a Service

windows

Detects powershell script installed as a Service

windows

Detects a ProcessHacker tool that elevated privileges to a very high level

windows

Detects blocking of process creations originating from PSExec and WMI commands

windows

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

windows · process_creation

Detects the use of NirCmd tool for command execution as SYSTEM user

windows · process_creation

Detects the use of NSudo tool for command execution

windows · process_creation

Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

windows · process_creation

Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

rpc_firewall · application

Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

windows · process_creation

Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

windows

Detects the use of smbexec.py tool by detecting a specific service installation

windows

Detects default CSExec service filename which indicates CSExec service installation and execution

windows · file_event

Detects CSExec service installation and execution events

windows

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

macos · process_creation

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

zeek

Detects PAExec service installation

windows

Detects user accept agreement execution in psexec commandline

windows · process_creation

Detects PsExec service installation and execution events

windows

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack

windows · pipe_created

Detects default CSExec pipe creation

windows · pipe_created

Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

windows · process_creation

Detects PAExec default named pipe

windows · pipe_created

Detects default RemCom pipe creation

windows · pipe_created

Detects default RemCom service filename which indicates RemCom service installation and execution

windows · file_event

Detects RemCom service installation and execution events

windows

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

windows

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

windows

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

windows · registry_set

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

zeek

Detects PsExec service default pipe creation

windows · pipe_created

Detects default PsExec service filename which indicates PsExec service installation and execution

windows · file_event

Detects the usage of the "net.exe" command to start a service using the "start" flag

windows · process_creation