Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects the execution of legitimate Remote Monitoring and Management (RMM) tools, such as AnyDesk, ScreenConnect, OptiTuneAgent, and SplashtopStreamer, when initiated from non-standard directories (outside 'C:\Program Files') or by command-line shells (powershell.exe, cmd.exe, wscript.exe, cscript.exe). This behavior is often abused by threat actors, including groups like Chaos RaaS, for persistence and remote access.
This rule detects VNC-based lateral movement activities within an internal network (East-West traffic).
The rule detects VNC (Virtual Network Computing) application usage on Windows systems, looking for specific indicators in conjunction.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
Detects VNC-based lateral movement activities. East to West traffic
Detects VNC-based activities. Looking for specific VNC processes
This rule detects potential indicators of compromise related to CVE-2026-20127 in Cisco Catalyst SD-WAN systems. It focuses on two main areas: 1) suspicious successful SSH authentications for the 'vmanage-admin' account, and 2) SD-WAN control plane connection events indicating a new 'up' state. The first part looks for specific log entries related to publickey authentication for 'vmanage-admin' from any source IP. The second part identifies control connection state changes to 'up' and extracts peer type, peer system IP, and public IP from the raw logs. The rule aims to surface events that require human confirmation by comparing them against known network designs and change records, as these events can indicate unexpected relationships between devices or unauthorized privileged access.
Detects successful administrative logins ('vmanage-admin') to a Cisco SD-WAN device from an IP address not on the authorized list. This could indicate exploitation of CVE-2026-20127, an authentication bypass vulnerability.
This rule detects Azure DevOps activities originating from new or rarely seen IP addresses outside of defined business hours. It establishes a baseline of historical IP addresses and flags activities from IPs that have been seen for fewer than a specified number of days, indicating potentially suspicious access.
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
This rule detects potential lateral movement within Azure by identifying instances where a Managed Identity of one Virtual Machine (VM) is used to execute commands on another VM. It specifically looks for Azure Activity logs where the caller is a Service Principal, the 'InitiatedBy' field (xms_mirid) contains 'resourcegroups', and the operation name indicates a 'runCommand' or a 'Microsoft.Compute' action. This combination suggests that a Managed Identity is being leveraged to perform actions across VMs, which could be indicative of an attacker moving laterally after compromising a VM with an attached Managed Identity.
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
This rule detects the execution of processes associated with a JWrapper-packaged SimpleHelp Remote Access Trojan (RAT). The execution from the specific 'ProgramData\JWrapper-Remote Access' directory is a strong indicator of the malicious activity described in the Cofense report. The rule specifically looks for 'Remote AccessWinLauncher.exe', 'windowslauncher.exe', and 'winpty-agent64.exe' being executed from 'C:\ProgramData\JWrapper-Remote Access'.
Detects exploitation of CVE-2026-24061, an authentication bypass in GNU telnetd, where the 'login' process is spawned with the '-f' flag to skip authentication and gain root access.
This detection identifies when a Managed Identity (Service Principal) successfully executes a 'RunCommand' on an Azure virtual machine. This activity is a key indicator of lateral movement, where an attacker, having compromised a resource with a Managed Identity, uses that identity's permissions to execute code on another VM.
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
Detects high-risk command execution (e.g., curl, wget, ssh) originating from AI agent runtime processes like OpenClaw/ClawdBot. This behavior is associated with threat actors using backdoored 'skills' to exfiltrate data or move laterally.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
The rule is designed to detect suspicious activities associated with Remote Monitoring and Management (RMM) tools by analyzing processes, file signatures, network connections, and firewall logs linked to known RMM tools and domains. The rule is valid.
This rule detects when popular Remote Monitoring and Management (RMM) tools initiate network connections to public IP addresses. This behavior can be indicative of legitimate administrative tasks, but also of malicious activity where adversaries use these tools for remote access and control within a compromised environment. The rule specifically filters out connections to private IP ranges to reduce false positives related to internal network communication.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of New Zealand and Australia, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common system services. The rule aims to identify potential unauthorized access attempts or compromised accounts leveraging unusual client software or scripts.
This rule detects successful user sign-ins to Azure AD from IP addresses located outside of New Zealand and Australia, where the User-Agent string matches a known list of suspicious user agents. It filters out common legitimate user agents to reduce false positives.
Page 35 of 42