| elastic |
Suspicious Service was Installed in the System |
production |
2026-10-06 |
| splunk |
Windows Snake Malware Service Create |
production |
2026-10-02 |
| splunk |
Windows Service Execution RemCom |
production |
2026-10-02 |
| splunk |
Windows ScManager Security Descriptor Tampering Via Sc.EXE |
production |
2026-10-02 |
| splunk |
Detect Renamed PSExec |
deprecated |
2026-09-23 |
| splunk |
Windows Service Created with Suspicious Service Name |
production |
2026-09-22 |
| elastic |
Unusual Windows Service |
production |
2026-09-18 |
| elastic |
Svchost spawning Cmd |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| elastic |
Remotely Started Services via RPC |
production |
2026-09-18 |
| elastic |
PsExec Network Connection |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution via Renamed PsExec Executable |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Systemd Service Started by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
Unusual Process For a Windows Host |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
System Shells via Services |
production |
2026-09-18 |
| splunk |
First Time Seen Running Windows Service |
experimental |
2026-05-13 |
| splunk |
Windows Service Created with Suspicious Service Path |
production |
2026-05-13 |
| splunk |
Windows Service Create SliverC2 |
production |
2026-05-13 |
| splunk |
Malicious Powershell Executed As A Service |
production |
2026-05-13 |
| splunk |
Linux Auditd Service Started |
production |
2026-05-13 |
| splunk |
Excessive Usage Of SC Service Utility |
production |
2026-05-13 |
| sigma |
WFP Filter Added via Registry |
experimental |
2025-10-23 |
| sigma |
Remote Access Tool Services Have Been Installed - Security |
test |
2024-12-07 |
| sigma |
Potential CobaltStrike Service Installations - Registry |
test |
2024-03-25 |
| sigma |
PUA - CSExec Default Named Pipe |
test |
2023-11-30 |
| sigma |
PUA - RemCom Default Named Pipe |
test |
2023-11-30 |
| sigma |
smbexec.py Service Installation |
test |
2023-11-09 |
| sigma |
PsExec Tool Execution From Suspicious Locations - PipeName |
test |
2023-09-20 |
| sigma |
PowerShell as a Service in Registry |
test |
2023-08-17 |
| sigma |
RemCom Service Installation |
test |
2023-08-07 |
| sigma |
CSExec Service Installation |
test |
2023-08-07 |
| sigma |
HackTool Service Registration or Execution |
test |
2023-08-07 |
| sigma |
CSExec Service File Creation |
test |
2023-08-04 |
| sigma |
PsExec Service Installation |
test |
2023-08-04 |
| sigma |
RemCom Service File Creation |
test |
2023-08-04 |
| sigma |
Remote Access Tool Services Have Been Installed - System |
test |
2023-06-22 |
| sigma |
Start Windows Service Via Net.EXE |
test |
2023-03-05 |
| sigma |
Rundll32 Execution Without Parameters |
test |
2023-02-28 |
| sigma |
PUA - CsExec Execution |
test |
2023-02-21 |
| sigma |
PUA - RunXCmd Execution |
test |
2023-02-14 |
| sigma |
PUA - NSudo Execution |
test |
2023-02-13 |
| sigma |
PUA - NirCmd Execution As LOCAL SYSTEM |
test |
2023-02-13 |
| sigma |
HackTool - SharpUp PrivEsc Tool Execution |
test |
2023-02-13 |
| sigma |
PUA - NirCmd Execution |
test |
2023-02-13 |
| sigma |
Potential CVE-2022-26809 Exploitation Attempt |
test |
2023-02-03 |
| sigma |
ProcessHacker Privilege Elevation |
test |
2022-12-25 |
| sigma |
PowerShell Scripts Installed as Services |
test |
2022-12-25 |
| sigma |
PSExec and WMI Process Creations Block |
test |
2022-12-25 |
| sigma |
PowerShell Scripts Installed as Services - Security |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - System |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - Security |
test |
2022-11-29 |
| sigma |
CobaltStrike Service Installations - System |
test |
2022-11-27 |
| sigma |
CobaltStrike Service Installations - Security |
test |
2022-11-27 |
| sigma |
PUA - PAExec Default Named Pipe |
test |
2022-10-26 |
| sigma |
PsExec Service File Creation |
test |
2022-10-26 |
| sigma |
PAExec Service Installation |
test |
2022-10-26 |
| sigma |
PsExec Default Named Pipe |
test |
2022-10-09 |
| sigma |
CosmicDuke Service Installation |
test |
2022-10-09 |
| sigma |
Metasploit Or Impacket Service Installation Via SMB PsExec |
test |
2022-10-05 |
| sigma |
Sliver C2 Default Service Installation |
test |
2022-08-25 |
| sigma |
DNS RCE CVE-2020-1350 |
test |
2022-07-12 |
| sigma |
DNS Events Related To Mining Pools |
test |
2022-07-07 |
| sigma |
Remote Server Service Abuse for Lateral Movement |
test |
2022-01-01 |
| sigma |
MITRE BZAR Indicators for Execution |
test |
2021-11-27 |