Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects the deployment of MeshCentral remote management agents and associated outbound communication to suspicious C2 infrastructure, identified in environments compromised by ShinyHunters. This rule monitors for specific process execution patterns involving meshctrl.js and meshagent, alongside network connections to known C2 domains and IP addresses.
Identifies the execution of MeshCentral for remote command execution.
This rule identifies the execution of MeshCentral for remote command execution, specifically looking for command-line arguments containing 'meshctrl.js' and 'RunCommand'. This activity has been observed in attacks such as those by ShinyHunters to stage payloads on compromised Oracle PeopleSoft servers.
This rule identifies the execution of MeshCentral for remote command execution by looking for specific command-line arguments. It specifically targets instances where 'meshctrl.js' and 'RunCommand' are present in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters.
Detects the use of 'sshpass' to supply a password to SSH while simultaneously disabling strict host key checking. This combination is often indicative of automated lateral movement or credential stuffing attempts where an attacker is trying to bypass host key verification to connect to multiple systems without manual intervention.
Detects network share enumeration commands executed inside a remote desktop session, matching post-access discovery of mapped corporate storage. This rule specifically looks for commands like 'net use', 'net view', PowerShell cmdlets such as 'Get-SmbShare', 'Get-PSDrive', 'Get-SmbMapping', WMI queries for 'Win32_LogicalDisk', or UNC path references ('\\') executed via 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'net.exe', or 'net1.exe' within a remote session.
Detects enabling of ESXi host shell via vSphere API for remote execution
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Detects the creation of archive files (ZIP, 7z, RAR, TAR, GZ) within common user staging directories such as Downloads, AppData Roaming, Desktop, or Temp folders. The detection specifically targets archives created by command-line shells (cmd, PowerShell), dedicated archiving utilities (7z, WinRAR, tar), or remote access tools (AnyDesk, Bomgar, ScreenConnect, Splashtop, Atera). This activity is indicative of data staging prior to exfiltration.
Detects Microsoft Management Console (mmc.exe) instantiated as a DCOM object (-Embedding) by the DCOM service host. This is a documented vector for DCOM lateral movement via the MMC20.Application COM object.
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Detects unauthorized GlobalProtect VPN logins from known malicious IPs.
Detects network device configuration commands via SSH
Detects ESXi hypervisor CLI access via direct SSH connection
Detects the execution of known remote access tools (e.g., AnyDesk, TeamViewer, RemotePC, IDriveRemotePC) from non-standard parent processes. This helps identify unauthorized or potentially malicious use of remote control software that bypasses standard application deployment or management processes.
Detects the use of two or more distinct remote access products by the same user on the same device within a one-hour window. This could indicate suspicious activity, such as an attacker attempting to maintain persistence or using multiple tools for different stages of an attack, or a legitimate user having multiple remote access tools installed and running concurrently.
Detects the RMMProject RTSC module spawning web browsers (Chrome or Edge) in a hidden desktop environment. This behavior is indicative of an adversary attempting to perform actions on a system without the user's direct knowledge or visibility, often associated with remote access and control.
Detects TeamViewer being used for unauthorized persistent remote access
This rule detects the execution of ScreenConnect, a remote access tool, directly spawned by ComputerDefaults.exe. This behavior is indicative of a UAC bypass technique, specifically observed in the 'Operation SilentCanvas' campaign.
Page 30 of 42