Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
This rule detects potential lateral movement by identifying processes spawned via WMI (e.g., wmic.exe, WmiPrvSE.exe) or PowerShell Remoting (WinRM, Invoke-Command, Enter-PSSession) that occur shortly after a successful network or remote interactive logon on the same host.
Detects a burst of lateral movement activity characterized by the use of administrative tools like PsExec or NetExec/CrackMapExec to execute commands or services on multiple distinct target hosts from a single source host within a short window. This pattern is commonly associated with ransomware affiliates or threat actors performing reconnaissance and mass deployment of malicious payloads prior to encryption.
Detects potential callback phishing (Telephone-Oriented Attack Delivery) by correlating phishing-themed emails containing phone numbers with no hyperlinks to the subsequent execution or installation of common remote monitoring and management (RMM) software on the same host within a six-hour window. The rule further refines this by ensuring the RMM tool was not previously installed on the user's system.
Detects anomalous remote access patterns on a single endpoint, specifically involving AnyDesk or TeamViewer sessions originating from multiple distinct geographical locations combined with usage by multiple distinct user accounts. This pattern is consistent with DPRK IT worker fraud (Wagemole) involving shared laptop farms.
Detects the Sauron Loader vishing chain: a mailbox hit by a high-volume, high-distinct-sender email bombing burst (raised from 20 to 50 emails/hour and now requiring 15+ distinct senders, to exclude single-sender retry loops or broken automation), followed within 2 hours by the same user launching Quick Assist or AnyDesk — consistent with an attacker posing as IT support after the flood. Also fixes a schema bug where EmailEvents was queried with TimeGenerated instead of Timestamp, and a post-join column reference bug.
Detects the execution of known remote access and support tools (Quick Assist, Microsoft Remote Assistance, or AnyDesk) on a host that has recently received a high volume of emails (over 50). This behavior often aligns with social engineering campaigns where a user is instructed to download or launch a remote support tool under false pretenses.
This rule detects the suspicious combination of PowerShell scripts executing download commands (Invoke-WebRequest, etc.) while initiated by scripting hosts (wscript.exe, cscript.exe), followed by activity associated with remote support tools (LogMeIn, ConnectWise, etc.). It also identifies network connections associated with these remote management platforms, suggesting potential unauthorized remote access or tool staging.
Detects the execution of known Remote Monitoring and Management (RMM) software installers or command-line arguments when invoked by PowerShell processes. This behavior is often indicative of malicious post-compromise activity where an adversary uses legitimate remote access tools to establish persistent command-and-control access.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
This rule detects the execution of common remote access and RMM (Remote Monitoring and Management) tools spawned directly from web browser processes (e.g., Chrome, Edge, Firefox). It further monitors for subsequent suspicious child process activity such as command shell execution or file operations performed by these RMM tools, which is a common pattern in post-exploitation and initial access activities.
Detects the execution of 'tscon.exe', a Windows utility used to control Remote Desktop sessions. The rule specifically alerts when 'tscon.exe' is executed with parameters indicative of session hijacking (such as '/dest:') or when it is invoked by suspicious processes or under SYSTEM privileges, which are characteristic of RDP session hijacking techniques used for privilege escalation and lateral movement.
Detects the execution or presence of AnyDesk.exe within directories containing 'UBP-Asset' that are outside of known, legitimate installation paths. This behavior often indicates an adversary attempting to use remote access software for persistent access or command and control, commonly disguised within unconventional directories.
Detects the execution of msiexec.exe (the Windows Installer) as a child process of remote support applications such as Quick Assist, Microsoft Remote Assistance (msra.exe), or AnyDesk. This pattern is commonly associated with remote access trojans and unauthorized software deployment during social engineering campaigns.
Detects the execution of msiexec.exe (the Windows Installer) as a child process of remote support applications such as Quick Assist, Microsoft Remote Assistance (msra.exe), or AnyDesk. This pattern is commonly associated with remote access trojans and unauthorized software deployment during social engineering campaigns.
Detects a sequence of events where a single user receives an unusually high volume of inbound emails (potentially vishing-related), followed shortly thereafter by the user executing common remote assistance or remote access tools (e.g., Quick Assist, AnyDesk). This pattern is consistent with social engineering tactics used in IT-support impersonation scams to facilitate the delivery of malware such as Sauron Loader.
Detects a potential vishing or technical support scam scenario by identifying a burst of email traffic to a user (email bombing) followed within one hour by the execution of a remote assistance tool (Quick Assist, Microsoft Remote Assistance, or AnyDesk) on the same user's endpoint.
Detects a potential post-compromise lateral movement sequence where a host, previously identified as accessing sensitive browser credential files by an unauthorized process, subsequently initiates RDP or WinRM connections to other internal hosts using an account not previously observed performing interactive logons on that source host.
This rule detects the initialization of an AWS CloudShell environment or session where Multi-Factor Authentication (MFA) was not explicitly recorded in the event data. Unauthorized access to CloudShell can provide an adversary with a command-line interface to interact with AWS APIs, potentially facilitating further malicious activities.
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects the installation or execution of common remote access tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop) using silent or unattended installation flags. This rule explicitly excludes activity originating from known administrative and management platforms such as Microsoft Intune and SCCM.
Page 6 of 42