Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects outbound TLS traffic to known remote access and management software domains (e.g., ScreenConnect, AnyDesk, TeamViewer), which are frequently abused by adversaries for establishing Command and Control (C2) channels.
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
This rule detects potential lateral movement by identifying suspicious child processes (such as cmd, powershell, or rundll32) spawned by WmiPrvSE.exe shortly after a remote interactive or network logon on the same device.
This rule detects potential lateral movement by identifying suspicious child processes (such as cmd, powershell, or rundll32) spawned by WmiPrvSE.exe shortly after a remote interactive or network logon on the same device.
Detects the execution of known remote monitoring and management (RMM) software often abused by threat actors following social engineering attempts, such as helpdesk impersonation, to establish persistence and remote access prior to deploying ransomware.
Detects the execution of the rdp2tcp tunneling tool in conjunction with RDP virtual channel activity using the 'rdp2tcp' channel name. This combination is a strong indicator of RDP-based protocol tunneling.
Detects the execution of the rdp2tcp tunneling tool in conjunction with RDP virtual channel activity using the 'rdp2tcp' channel name. This combination is a strong indicator of RDP-based protocol tunneling.
Detects the execution of the rdp2tcp tunneling tool in conjunction with RDP virtual channel activity using the 'rdp2tcp' channel name. This combination is a strong indicator of RDP-based protocol tunneling.
Detects a sequence of multiple VPN authentication failures from a single IP address followed by a successful authentication within a 10-minute window, which is indicative of a successful credential brute force attack.
Detects a sequence of multiple VPN authentication failures from a single IP address followed by a successful authentication within a 10-minute window, which is indicative of a successful credential brute force attack.
Detects the execution or deployment of MeshAgent, a legitimate Remote Monitoring and Management (RMM) tool, which is often abused by adversaries to maintain persistence and command-and-control access. The rule monitors for common process names such as meshagent.exe and mvtcs.exe, as well as command-line arguments containing 'meshagent'.
Detects a successful VPN authentication event followed within 30 minutes by the execution of the MeshAgent RMM tool or its renamed variant mvtcs.exe. This behavioral pattern is associated with initial access via compromised VPN credentials followed by the deployment of remote monitoring and management (RMM) tools for persistence and command and control.
Detects the execution of MeshAgent, a remote monitoring and management (RMM) tool, by monitoring for its associated process names (meshagent.exe, mvtcs.exe) or command lines containing the string 'MeshAgent'. Adversaries often abuse such legitimate remote access tools to establish persistent command and control channels or to perform unauthorized administrative activities.
Detects anomalous SSH sessions originating from potentially suspicious IP addresses that utilize an 'SSH-2.0-Go' banner and immediately perform file creation operations associated with the RedTail botnet (e.g., shell scripts or architecture-specific binaries).
Detects Evil-WinRM / WinRM-fs usage or wsmprovhost.exe-spawned PowerShell tied specifically to bird-agent backdoor artifacts (cplsupport, wtass, config.toml) or encoded/download-cradle command patterns, rather than any WinRM session, reducing noise from routine remote administration.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Page 13 of 42