Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
This rule monitors for RDP connections (Windows Event ID 4624 Logon Type 10) and RDP client launches (mstsc.exe) within an environment. It enriches these events by checking against a baseline of historically observed source-to-destination host pairs. A new or previously unseen connection pair triggers an alert, helping to identify potential lateral movement.
Detects the execution of Microsoft Quick Assist (or related Remote Desktop clients) shortly after activity from Microsoft Teams. This pattern is consistent with social engineering tactics where an attacker impersonates IT personnel over a Teams call to persuade a victim to provide remote access to their workstation.
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
Detects potential exploitation of RustDesk remote access software, focusing on unauthorized process execution from RustDesk-related binaries (including session relay and rendezvous components) and the presence of documented proof-of-concept (PoC) artifacts associated with session permission bypass vulnerabilities.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects instances where Microsoft Teams or its associated process spawns remote assistance utilities such as Quick Assist, Microsoft Remote Assistance (msra), or Remote Desktop Connection Manager (msrdcw). This behavior may indicate an attacker abusing legitimate remote access software for command and control or unauthorized remote control.
Detects the execution of known remote access or remote support tools (AnyDesk, ScreenConnect, QuickAssist, or Atera) when the parent process is Microsoft Teams. This behavior may indicate an attempt by an adversary to leverage legitimate remote access software for unauthorized access, potentially following an initial compromise via social engineering or spear-phishing over Teams.
This rule detects suspicious process activity initiated from or under the context of the SimpleHelp remote access tool. It monitors for common post-exploitation patterns including the execution of Python-based scripts associated with authentication bypass and OIDC credential harvesting, the spawning of Node.js processes, and the execution of common command interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) typically used by adversaries to gain further control over a compromised system.
Detects unauthorized modifications to the 'system.conf' configuration file associated with the AnyDesk remote desktop application. Adversaries may modify this file to change AnyDesk settings, specifically to suppress the requirement for user consent when establishing remote interactive sessions, effectively allowing for stealthy persistence and unauthorized remote access.
Detects anomalous SSH connections originating from internal network appliances or DMZ-segment devices (e.g., storage, firewalls) to multiple internal network hosts. This behavior is indicative of lateral movement or SSH tunneling as observed in the VerdantBamboo BRICKSTORM campaign, where edge devices are leveraged as pivot points.
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects the execution of scripting interpreters and remote management tools originating from the SimpleHelp RMM process tree. This activity is indicative of post-exploitation abuse where an attacker, having hijacked a technician session (e.g., via CVE-2026-48558 OIDC bypass), uses the RMM console to execute commands on remote endpoints.
Detects network activity over port 1313 containing Socket.IO payloads with keywords 'control' and 'escape', indicative of a command and control or remote access channel often associated with interactive shells or administrative backdoors.
This rule detects the presence of KVM-over-IP devices and spoofed USB peripherals, which are commonly associated with illicit remote access, particularly by DPRK IT workers.
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
Page 20 of 42