Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
This rule monitors for the execution of common remote access and support tools (AnyDesk, TeamViewer, ScreenConnect, QuickAssist) that originate from suspicious file paths (e.g., Temp, AppData, Downloads) or are launched with silent installation flags, or appear to be installed via msiexec by non-standard parent processes. These behaviors are common indicators of adversaries attempting to establish unauthorized persistent remote access or deploying remote support tools as part of a post-exploitation activity.
Detects suspicious use of QEMU virtualization software within an environment, specifically when associated with ConnectWise ScreenConnect. This includes the creation of custom QEMU image files within the ScreenConnect Files directory, the execution of the QEMU binary using those images, the extraction of QEMU archives using 7-Zip, or instances where ScreenConnect processes spawn the QEMU binary directly. This pattern is indicative of unauthorized use of virtual machines to facilitate persistence, lateral movement, or tool staging.
Detects anomalous SSH daemon (sshd) activity characterized by the installation or execution of a non-standard sshd binary (often located in /tmp or /var/tmp) or the execution of sshd with suspicious command-line arguments (custom ports or custom configuration files), followed by modifications to the authorized_keys file. This behavior is indicative of unauthorized persistence or backdoor access.
Detects the execution of known remote access or remote support tools (AnyDesk, ScreenConnect, QuickAssist, or Atera) when the parent process is Microsoft Teams. This behavior may indicate an attempt by an adversary to leverage legitimate remote access software for unauthorized access, potentially following an initial compromise via social engineering or spear-phishing over Teams.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).
Detects the execution of ScreenConnect.ClientService.exe with command line arguments containing 'servermanagemen' or 'Microsoft Update Service'. This pattern is often associated with the use of ConnectWise (ScreenConnect) remote access software, which can be leveraged for legitimate administration or malicious remote control.
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
This behavior was observed in pair with modification of VPN SSL settings.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
This rule detects the execution of Microsoft Quick Assist (msra.exe or quickassist.exe) on endpoints. It elevates the risk score if the event is preceded by Microsoft Teams activity within 30 minutes or occurs on a host exhibiting high volumes of email traffic, which may indicate remote access tool abuse following a social engineering or phishing attempt.
Detects the execution of known remote access and monitoring software (RMM/RAT) when launched as a child process of common web browsers or email clients. This behavioral pattern is frequently observed in phishing attacks where users are tricked into downloading and executing remote support tools, a technique often associated with the Luna Moth (Silent Ransom Group) campaign.
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.
Detects the execution, installation, or configuration of Tailscale, a legitimate remote access tool. The rule monitors for common command-line arguments like '--authkey' and 'up', service-related activity, and execution from non-standard file paths. It flags instances where Tailscale is spawned by common script interpreters or command shells, which is a common indicator of unauthorized remote access or C2 implant activity.
Detects the spawning of common command-line shells (cmd.exe, powershell.exe, net.exe) by the Windows Remote Management (WinRM) process, wsmprovhost.exe. This activity is indicative of lateral movement or remote command execution via WinRM.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Page 21 of 42