Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
Detects unusual SSH activity originating from or involving Cisco vManage systems, specifically monitoring outbound SSH connections to internal network segments (10.0.0.0/8) or the execution of SSH processes with command-line arguments indicative of management tasks (vsmart, vbond).
Detects potentially unauthorized or malicious behavior associated with the RustDesk remote access tool. The rule monitors for unsigned screen capture attempts, spawning of shell or scripting processes, cross-process input injection, and network communication over non-standard or unexpected ports.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Detects instances where the RustDesk remote control application spawns suspicious child processes, such as command interpreters or scripting utilities. This behavior is indicative of a permission bypass exploit, where an attacker leverages an existing authorized remote session to gain interactive command-line access or execute unauthorized commands on the target host.
This rule detects potentially unauthorized or suspicious Remote Desktop Protocol (RDP) activity by monitoring for instances of 'mstsc.exe' initiated with specific command-line arguments, or identifying child processes spawned by RDP-related binaries ('mstsc.exe', 'rdpclip.exe') that are not typically associated with standard RDP functionality.
Detects Azure Bastion RDP or SSH tunnel sessions initiated by users who have no history of using Bastion in the last 60 days, or by users connecting from a geographic location not observed in their recent sign-in history. This behavior may indicate account compromise and unauthorized lateral movement attempts.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
This rule detects the execution and network activity of known Remote Monitoring and Management (RMM) tools such as AnyDesk, TeamViewer, and ScreenConnect. It assigns a risk score based on whether the activity occurs outside of defined business hours (8 AM - 6 PM) and whether the tool is initiating an outbound connection on port 443, a common pattern for C2 communication.
This rule detects inbound Remote Desktop Protocol (RDP) connections (ports 3389, 3390, 3391) that are initiated by common scripting engines such as wscript.exe, cscript.exe, or powershell.exe. This behavior can be indicative of post-exploitation activity where an attacker uses scripts to establish remote access.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
Detects remote management software launched from an existing RDP session, indicating nested remote access or pivoting.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.
Detects the installation or execution of ScreenConnect originating from the Azure Run Command extension context. This indicates potential unauthorized remote access tool deployment.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects the execution of known remote access tools (e.g., AnyDesk, TeamViewer, RemotePC, IDriveRemotePC) from non-standard parent processes. This helps identify unauthorized or potentially malicious use of remote control software that bypasses standard application deployment or management processes.
Detects Microsoft Management Console (mmc.exe) instantiated as a DCOM object (-Embedding) by the DCOM service host. This is a documented vector for DCOM lateral movement via the MMC20.Application COM object.
Detects the execution of PsExec (psexec.exe or psexec64.exe) with command-line arguments indicating remote execution to a network share and the use of administrative credentials (e.g., -s, -u, -p, -c). This activity is often associated with lateral movement and remote service execution by attackers, including ransomware groups like 'The Gentlemen'.
Page 29 of 42