Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects a multi-stage attack pattern involving a 'spam bomb' (high volume of inbound emails) followed by an external Microsoft Teams message and the subsequent execution of Windows Quick Assist (quickassist.exe or msra.exe) on the target endpoint. This behavior is highly indicative of a tech support scam or social engineering attack where an adversary floods a user's inbox to create urgency, contacts them via Teams, and convinces them to initiate a remote support session.
Detects the execution of the NetSupport RAT client process (client32.exe). This tool is often abused by threat actors for remote control, frequently deployed following social engineering lures such as ClickFix or BitB (Browser-in-the-Browser) attacks.
This rule detects outbound network connections made by the RustDesk process to non-corporate relay server IP addresses on the default RustDesk relay ports (21115, 21116, 21117). This behavior may indicate an unauthorized remote control session establishment, bypassing expected organizational proxy or relay controls.
This rule detects the use of PowerShell or Command Prompt to execute commands related to Remote Monitoring and Management (RMM) software or remote management tools such as IDrive or TeamViewer. It specifically looks for command-line arguments involving RMM-related keywords combined with execution flags or piping operators, which is a common pattern for automating the deployment, configuration, or malicious use of these remote access tools.
Detects Azure Bastion RDP or SSH tunnel sessions initiated by users who have no history of using Bastion in the last 60 days, or by users connecting from a geographic location not observed in their recent sign-in history. This behavior may indicate account compromise and unauthorized lateral movement attempts.
Detects the use of living-off-the-land tools like plink.exe, netsh.exe, and ssh.exe to create tunnels that forward RDP traffic (port 3389). This behavior is often indicative of an adversary attempting to bypass network controls or hide RDP sessions by tunneling them through other protocols or non-standard port configurations.
This rule monitors for the creation of the 'adprinterpipe' named pipe by the AnyDesk remote support application. This behavior can be indicative of remote session activity or misuse of the AnyDesk software, often used as a vector for remote command and control.
Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.
Detects inbound network connections from a specific list of known suspicious or untrusted external IP addresses targeting sensitive management ports (SSH, NETCONF, and vManage-HTTPS-API). The rule identifies if the connection is made by a privileged account (e.g., admin, root) to highlight potential unauthorized management access attempts.
This rule detects potentially malicious activity associated with the RustDesk remote access tool. It monitors for two conditions: 1) RustDesk spawning suspicious child processes (e.g., shells, scripting engines, or network tools) that indicate post-exploitation behavior. 2) The RustDesk binary being executed from an unusual parent process, which may indicate session hijacking or unauthorized installation.
This rule detects the deployment and execution of the RustDesk remote access tool in conjunction with potential staging of installation artifacts and observed prior activity related to BumbleBee/Adaptix C2. It correlates process execution, file creation, and network connectivity to the RustDesk relay infrastructure to assign a risk score, helping identify potential unauthorized remote access or malicious persistence.
Detects the execution of known Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Action1) from user-writable directories such as Temp, Downloads, or INetCache. Adversaries frequently utilize these legitimate remote access tools to establish persistence or command-and-control channels, often dropping them into temporary directories to avoid detection.
This rule detects anomalous sign-in attempts to VPN or SSO services by identifying deviations from a user's established baseline of device and location combinations. It flags sign-ins where there are at least two anomalies (new country, new ASN, new device ID, new user agent), or specific critical combinations like a new country and new device, or an unmanaged device signing in from a new country or ASN. This pattern is consistent with adversaries using stolen credentials, potentially from infostealer logs, to access enterprise resources.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
Detects the execution of known remote access and remote management tools (e.g., TeamViewer, AnyDesk) where the process was initiated by a web browser, suggesting potential drive-by downloads or social engineering attacks involving remote access software.
Detects the execution of Dropbear SSH binaries (dropbear, dropbearkey, dropbearmulti) on identified OT, ICS, or SCADA assets. The rule flags suspicious configurations such as the use of non-standard ports (2222, 44818), remote port forwarding, or running in the foreground, which may indicate unauthorized remote access or tunneling on sensitive operational technology infrastructure.
Detects the execution of PowerShell commands used to initiate remote sessions (e.g., New-PSSession, Invoke-Command) targeting specific remote hosts, excluding localhost connections and common system processes. This behavior is often associated with lateral movement or remote administration activities.
Detects instances where common administrative tools (such as PowerShell, cmd, or network utilities) are launched as child processes of the WinRM service process (wsmprovhost.exe) shortly after an inbound WinRM network connection is established on port 5985 or 5986.
Detects instances where common administrative tools (such as PowerShell, cmd, or network utilities) are launched as child processes of the WinRM service process (wsmprovhost.exe) shortly after an inbound WinRM network connection is established on port 5985 or 5986.
Detects unauthorized execution of MeshCentral's meshctrl.js to interface with a local WebSocket endpoint on PeopleSoft servers, likely indicative of session hijacking post-exploitation of CVE-2026-35273 by the ShinyHunters threat group.
This rule detects scenarios where a new local user account is created on a Windows system during off-hours (between 7 PM and 7 AM), followed by the execution of known remote access tools within a 30-minute window of that account creation. This combination is often indicative of unauthorized persistent access establishment.
Page 24 of 42