Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
The following KQL query focuses on detecting cases where files are created, modified, or otherwise accessed via RDP from another computer. Its main objective is to verify whether, during an RDP session, the connection has mapped a local disk or other redirected device — allowing us to easily identify potential cases of data exfiltration through RDP file transfer
Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This specific command line indicates that TeamViewer_Desktop.exe is being launched by TeamViewer_Service.exe with an IPC port of 5939 and module 1, which is characteristic of a remote connection being established. An investigator can verify connection details by reviewing the "incoming_connections.txt" log file in the TeamViewer folder.
This detection identifies SSH being enabled on ESXi hosts. Enabling SSH on ESXi can be an early indicator of malicious activity, as threat actors often use SSH to gain persistent remote access after compromising credentials or exploiting vulnerabilities. The rule specifically looks for syslog messages indicating that SSH access has been enabled.
Detects network connections initiated by Microsoft Quick Assist (QuickAssist.exe) to its official relay server. This activity is expected for legitimate Quick Assist usage, but monitoring it can help identify unauthorized remote access or potential abuse of the tool.
The analytic detects the use of SSH to move laterally and execute a script or file on a remote host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific SSH command-line parameters and URLs. This activity is significant as it may indicate an attacker attempting to execute remote commands or scripts, potentially leading to unauthorized access or control over additional systems. If confirmed malicious, this could result in lateral movement, privilege escalation, or the execution of malicious payloads, compromising the security of the network.
Detects M365 Copilot users accessing from multiple geographic locations to identify potential account compromise, credential sharing, or impossible travel patterns. The detection aggregates M365 Copilot Graph API events per user, calculating distinct cities and countries accessed, unique IP addresses, and the observation timeframe to compute a locations-per-day metric that measures geographic mobility. Users accessing Copilot from more than one city (cities_count > 1) are flagged and sorted by country and city diversity, surfacing accounts exhibiting anomalous geographic patterns that suggest compromised credentials being used from distributed locations or simultaneous access from impossible travel distances.
The analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment.
This rule detects VPN connections originating from countries that are not the user's usual work country. It leverages VPN logs, specifically Zscaler VPN logs, to identify active connections and compares the source IP's country with a lookup of the user's expected work country. Alerts are generated when a mismatch is found, indicating a potentially unauthorized or suspicious access attempt.
KQL Query
Detects Chaos C++ ransomware payloads based on known file hashes and unique embedded strings from the malware.
This analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. The rule compares observed process names with a list of known remote access software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects the installation and configuration of a TacticalRMM agent where specific command-line flags (--api, --auth, --client-id, --site-id, --agent-type) are used. This indicates the agent is being configured to connect to a particular RMM server with authentication and client/site identification. This activity could signify a threat actor attempting to register the agent with their own controlled RMM infrastructure for persistent remote access.
This rule identifies unusual activity from locations not previously observed for a user within a defined lookback period. It leverages Microsoft Entra ID (Azure AD) Behavior Analytics and SigninLogs to baseline legitimate user locations and filter out trusted devices/IPs. The rule flags unusual activity where the source IP location is new for the user and exceeds a configurable threshold of 'unusual' behavior indicators, while also excluding specified trusted countries.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
This rule detects the connection of specific USB devices that are commonly associated with IP KVM (Keyboard, Video, Mouse) devices. It identifies these devices by checking the 'Manufacturer' field for 'PiKVM' or 'tinypilot', the 'vendorid' for a specific hexadecimal string ('6b65796d696d6670690'), or the 'SerialNumber' for 'CAFEBABE'. The rule monitors various USB device connection events such as 'USBDeviceConnected', 'UsbDriveMounted', 'UsbDriveUnmounted', 'UsbDeviceDisconnected', 'DeviceDisplayConnected', and 'PnpDeviceConnected' within 'DeviceEvents'. The presence of such devices can indicate remote access or potential compromise, as IP KVMs allow network-based control of a computer.
Detects potential exploitation of a critical ABAP code injection vulnerability (CVE-2025-42957) in SAP S/4HANA. An attacker with low-level privileges can leverage a vulnerable RFC module, /SLOAE/DEPLOY, to execute arbitrary code and gain full control of the system.
Page 37 of 42