Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
Detects the execution of known remote access software (e.g., AnyDesk, TeamViewer, Rclone, ScreenConnect) from non-standard file paths or when launched by suspicious parent processes such as cmd.exe, powershell.exe, or script interpreters. This behavior is indicative of potential adversary usage of living-off-the-land techniques or lateral movement via third-party remote access utilities.
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
This rule detects successful SSH authentications using the GSSAPI-with-MIC mechanism. This can indicate legitimate user logins or, in some cases, an adversary using valid credentials to access a system via SSH.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.
Detects the execution of legitimate Windows remote assistance tools (Quick Assist, MSRA) shortly after potential external collaboration activity in Microsoft Teams. This can indicate an adversary leveraging social engineering or remote access software to establish a foothold or conduct unauthorized remote support sessions.
Identifies the use of tscon.exe without authorization to hijack or "shadow" active RDP sessions, a key lateral movement and spying technique. The rule specifically looks for tscon.exe being executed with command-line arguments '/dest:console' or '/dest:rdp-tcp', which are indicative of attempting to connect to or shadow an existing RDP session.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule identifies the MeshCentral agent by process image name and common deployment paths or by its execution via common shell/download utilities. It also looks for the creation of the ransom note file 'README-IF-YOU-SEE-THIS-YOU-VE-BEEN-HACKED.TXT'.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
This rule detects modifications to SSH authorized_keys files on Linux-based SD-WAN controllers, or successful SSH public key authentication events involving the vmanage-admin user, including attempts to identify authentication from unexpected source IP addresses.
Detects the same authentication session or token identifier used from geographically inconsistent locations within a short period. This could indicate session hijacking or an adversary using a compromised session from a different location.
This rule detects the use of PowerShell or Command Prompt to execute commands related to Remote Monitoring and Management (RMM) software or remote management tools such as IDrive or TeamViewer. It specifically looks for command-line arguments involving RMM-related keywords combined with execution flags or piping operators, which is a common pattern for automating the deployment, configuration, or malicious use of these remote access tools.
Detects anomalous child process execution by RustDesk, including shell spawning (cmd, powershell, etc.) or internal session-related process manipulation which may indicate unauthorized remote control, session hijacking, or exploitation of proof-of-concept permission bypass tools.
Detects the execution of Remote Monitoring and Management (RMM) software initiated by common Windows script interpreters. This pattern is indicative of unauthorized deployment of remote access tools, often used by adversaries to establish persistence and command-and-control channels following initial compromise.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Detects the execution of RustDesk, a legitimate remote access tool, specifically when running with service or tray command-line arguments. This activity may indicate the installation of remote management capabilities by an adversary or authorized administrative activity.
Page 28 of 42