Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
These are extracted IoCs from a QuimaRAT sample I tore apart on my personal blog, found in the resources linked below. This is just one of many samples, so while it is certainly not all encompassing pertaining to all QuimaRAT activity, it does a great job serving as a starting point. As you will read in my analysis, QuimaRAT relies on a config file created that allows for many parameters to be changed. I did my best to focus on high-fidelity IoCs and not rely on any easily modified values in the configuration file.
Detects the creation of explorer.exe processes on non-default Windows desktops, which is a known indicator of Hidden VNC (HVNC) activity often utilized by the Dolphin X stealer. The rule mitigates false positives by excluding legitimate non-default desktop uses (like RDP/Citrix/VDI brokers) and requires correlation with a recent network connection from the newly spawned explorer.exe process.
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects ChonkyChicken's monitor_list enumeration chained with a screen_start command in the same C2 session.
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects the execution of anydesk.exe from user-writable directories such as AppData, Temp, Downloads, or Music. This behavior is indicative of potential unauthorized use of remote access software, which may be deployed by an adversary for persistence or establishing a command and control channel outside of standard administrative tools.
The aim of this query is detect SSH connections attempts where the external sources are specifying babeld (Network Protocol) or Conker (Network Conf. Manager) as parameters to establish a connection, is detect suspicious activity such as:
Unauthorized SSH connections.
Malicious use of SSH for lateral movement within a network.
Exfiltration attempts via SSH tunneling.
Unauthorized SSH connections.
Malicious use of SSH for lateral movement within a network.
Exfiltration attempts via SSH tunneling.
Detects Remote Interactive RDP logon events targeting systems identified as servers or critical infrastructure, using the DeviceLogonEvents data source.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
This rule detects unauthorized or suspicious access to the Komari remote administration panel over unencrypted HTTP. Detecting such access is critical as it indicates potential management interface exposure or unauthorized administrative activity within the network.
Detects inbound Remote Desktop Protocol (RDP) connections targeting internal Windows devices from public IP addresses. This rule identifies potential unauthorized remote access, brute-force activity, or the exposure of RDP services to the public internet.
Detects the execution of the legitimate AnyDesk remote access tool when it is launched from a non-standard file path containing '\music\', which may indicate an attempt to hide the executable in a less suspicious directory.
This rule detects the silent installation of AnyDesk with persistence enabled via the '--start-with-win' flag. This behavior is indicative of unauthorized remote access tool deployment, often used for establishing persistent command and control.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
Detects anomalous internal lateral movement activity where the Remote Desktop client (mstsc.exe) establishes network connections to multiple distinct internal destinations within a short window, potentially indicating an attacker traversing the network.
This rule detects successful Remote Desktop Protocol (RDP) logons (Event ID 4624 with Logon Type 10) and the execution of the Remote Desktop Connection client (mstsc.exe). It monitors for signs of remote interactive access to windows endpoints, which can indicate unauthorized access or legitimate administrative activity.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Detects SSH traffic originating from designated edge appliances (e.g., firewalls, NAS devices) directed towards internal network destinations. This pattern is often indicative of network pivoting, lateral movement, or unauthorized remote access from exposed or compromised perimeter assets.
Page 19 of 42