Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
Detects the initiation of an AWS Systems Manager (SSM) Session Manager session. The 'StartSession' API call is used to establish interactive remote shell sessions to managed instances (such as EC2). Monitoring this activity is critical for identifying potential remote administrative access, which could be abused for unauthorized management of cloud resources.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
This rule detects the execution of known Remote Monitoring and Management (RMM) or remote access tools on devices where they have not been observed within the previous 90-day baseline (excluding the most recent 7 days). This pattern is often indicative of an adversary introducing unauthorized remote access capabilities for persistence or lateral movement.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
This rule detects the execution of known Remote Monitoring and Management (RMM) or remote access tools on devices where they have not been observed within the previous 90-day baseline (excluding the most recent 7 days). This pattern is often indicative of an adversary introducing unauthorized remote access capabilities for persistence or lateral movement.
This rule detects the execution of QuickAssist.exe or RemSupp.exe on a host where Microsoft Teams has also been executed within the last day. This pattern may indicate the use of built-in remote support tools in conjunction with communication platforms, potentially for unauthorized remote access or suspicious remote assistance activities.
Detects Quick Assist (msra.exe/quickassist.exe) being launched on a device within a short window after the same user signed into Microsoft Teams, consistent with UNC6692's vishing tradecraft where actors impersonate internal IT support over Teams and coerce victims into granting remote access via Quick Assist to deploy the Edgecution malware suite.
This rule detects Remote Interactive (RDP) logon events performed by a local administrator account where the source of the connection is identified as the local host (127.0.0.1, ::1) or the device itself. This pattern is indicative of attackers using tunneling tools, such as the SNOWGLAZE SOCKS proxy, to relay RDP traffic through a compromised host to bypass network-level security controls.
Detects unauthorized remote access sessions within N-able N-central by monitoring the Windows Application log for events indicating usage of the default 'MSP Support' account or source IP addresses associated with active exploitation of CVE-2026-18577.
Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Page 18 of 42