Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects outbound RDP-over-TLS connections using non-standard high-numbered ports (64350, 64330, 65535, 65111, 61256), characteristic of SilkParasite command and control infrastructure. The rules trigger on known C2 IP addresses and general suspicious RDP behavior on these specific ports.
Detects RDP-over-TLS/NLA traffic occurring over non-standard high ports, which is often indicative of C2 communication or lateral movement associated with the SilkParasite infrastructure cluster.
Detects outbound TLS-encrypted network traffic directed towards known SilkParasite infrastructure using non-standard high ports commonly associated with RDP-over-TLS (NLA). The rule identifies potential Command and Control (C2) activity by flagging connections to suspicious IP/port combinations typical of this adversary cluster.
Detects the execution of the MeshCentral remote management agent (meshagent.exe) or processes masquerading as the agent using the known alias 'mvtcs.exe'. This rule identifies the start of these processes to detect unauthorized or potentially malicious remote management activity.
Detects anomalous remote access or VPN login activity for a user account, characterized by either logins from multiple distinct countries or logins occurring during off-hours (between 8:01 PM and 5:59 AM). This rule helps identify potential credential abuse where valid accounts are being leveraged from unexpected locations or times.
Detects the execution of MeshAgent or mvtcs (MeshCentral) binaries, which are commonly used for legitimate remote management but can also be used as unauthorized remote access tools by adversaries.
Detects when the ScreenConnect remote administration client process spawns common command-line or scripting interpreters. This behavior is indicative of an interactive session or remote command execution performed via the ScreenConnect tool, which is frequently abused by threat actors for lateral movement and remote control.
This rule monitors for suspicious activity originating from the WinRM service host (wsmprovhost.exe). It detects when command shells (cmd.exe, powershell.exe) are spawned by WinRM with known malicious command-line arguments (e.g., Evil-WinRM tools), monitors for the creation of potentially malicious configuration files (e.g., config.toml), and identifies established network connections to common WinRM ports (5985/5986) to detect unauthorized remote sessions.
Detects the execution of common command-line and scripting tools initiated by ScreenConnect (ConnectWise) remote administration processes. This pattern often indicates unauthorized remote access, lateral movement, or post-compromise activity where legitimate administrative software is abused to run arbitrary commands.
Detects instances where a service account (indicated by a trailing $ in the username, excluding computer accounts) authenticates to three or more distinct hosts within a short time frame. This behavior is indicative of potential lateral movement or automated discovery activities using a compromised service credential.
Detects successful VPN authentication events targeting SonicWall devices during non-business hours (between 20:00 and 06:00, or on weekends). This behavior is characteristic of initial access tradecraft often employed by ransomware affiliates to gain network entry with minimal operational noise.
Detects successful remote authentication events originating from an external source IP address via a SonicWall SSL-VPN, as identified by relevant login fields. This rule serves as a proxy for identifying initial access attempts often associated with ransomware activity, such as Akira, which leverage compromised VPN credentials.
Detects outbound TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused for lateral movement or protocol tunneling of services such as RDP to bypass network ingress filtering.
Detects instances where the ScreenConnect remote access client processes perform file creation or modification actions that are not preceded by or correlated with legitimate session activity logs (such as 'SessionConfirmed' or 'TransferFiles') within a 5-minute window. This behavior may indicate an unauthorized remote session or abuse of the remote access tool.
Detects instances where the ScreenConnect remote support client initiates outbound network connections to an unusually high number of distinct remote IP addresses (greater than 5). This behavior is characteristic of unauthorized lateral movement, reconnaissance, or establishing multiple C2 tunnels via a legitimate RMM tool.
Detects instances where permissions related to file transfers are granted or accessed within a ScreenConnect remote access session. This rule monitors for session-related events or permission updates that could indicate an attacker leveraging the remote access tool to exfiltrate data or interact with the filesystem.
Detects when ScreenConnect client processes (ClientService.exe or WindowsClient.exe) spawn child processes that are not part of the standard ScreenConnect application suite. This behavior is indicative of unauthorized use of remote access tools for command execution or lateral movement.
Detects Remote Desktop Protocol (RDP) connections established over known suspicious high ports or to specific remote IP addresses associated with known C2 operator infrastructure (SpiceRAT). This behavior indicates potential remote interactive access by an adversary.
This rule detects the execution, file creation, or registry modification associated with specific ScreenConnect (ConnectWise Control) installation artifacts that align with known suspicious deployment patterns. It monitors for binaries and configuration artifacts that may indicate the unauthorized installation or persistence of remote administration tools.
Detects outbound RDP-over-TLS traffic directed toward known SilkParasite C2 IP addresses on specific high-numbered ports, or generic RDP-over-TLS patterns on those same non-standard ports, which suggests tunneling or unauthorized remote access.
Detects the execution of MeshAgent or mvtcs (MeshCentral) binaries, which are commonly used for legitimate remote management but can also be used as unauthorized remote access tools by adversaries.
Page 11 of 42