Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects outbound network traffic from internal servers to known Remote Monitoring and Management (RMM) platforms (AnyDesk, ScreenConnect, Atera). This activity is often used by adversaries to establish covert command and control (C2) channels and remote access to internal resources.
This rule detects the execution of common remote access tools (Quick Assist, AnyDesk) on a host that does not have a prior history of using those specific tools. This is intended to identify potential hands-on-keyboard activity by adversaries following initial access via social engineering, such as vishing or email-bombing, where they attempt to establish a persistent remote access foothold.
Detects network activity associated with the RatHat Android malware, specifically focusing on its use of WebSocket-based FRP (Fast Reverse Proxy) tunnels for command and control, session initialization, configuration retrieval, and local loopback proxy communication.
Detects successful VPN logins that bypass multi-factor authentication (MFA) and originate from unusual ASN/IP addresses or occur during atypical hours. This behavior is indicative of potential unauthorized access using compromised credentials, consistent with threat actor patterns that exploit environments lacking mandatory MFA enforcement.
This rule monitors for two indicators of potentially malicious WinRM activity: first, the execution of suspicious child processes (e.g., cmd.exe, powershell.exe, rundll32.exe, certutil.exe) originating from the Windows Remote Management host process (wsmprovhost.exe); and second, a 'fan-out' pattern where a single account establishes WinRM/PSRemoting sessions on three or more distinct hosts within a short time window, which is often indicative of automated lateral movement or credential abuse.
Detects the use of the Windows Terminal Services console tool (tscon.exe) to hijack active or disconnected Remote Desktop sessions. Attackers often execute this with SYSTEM privileges, frequently initiated via service control utilities like sc.exe, schtasks.exe, or services.exe, to gain unauthorized access to user sessions without requiring credentials.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
Detects network activity associated with NetSupport Manager remote access software, specifically monitoring for connections to known malicious domains and infrastructure, as well as recurring beaconing patterns indicative of command-and-control behavior.
Flags installation of RMM tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) on an endpoint shortly after that user's account undergoes a password/MFA reset — matches the post-vishing tooling pattern CrowdStrike attributes to Mutant Spider (loaders including PrionFlaire and SocksLoader) and Scattered Spider.
Detects the execution of known Remote Monitoring & Management (RMM) software on Windows systems. This behavior is frequently abused by threat actors, including Scattered Spider, to maintain persistent access after gaining control via social engineering or identity-based attacks (e.g., vishing-driven credential or MFA resets).
This rule identifies potential RDP-based lateral movement by detecting when a single user account successfully authenticates to multiple distinct hosts using LogonType 10 (RemoteInteractive) within a 1-hour time window. A threshold of three or more distinct hosts is used to flag activity that deviates from typical single-host RDP usage.
Detects the launch or execution of common remote access tools such as AnyDesk, TeamViewer, Quick Assist, or Microsoft Remote Assistance (msra.exe) on an endpoint, excluding instances where these tools act as the parent process. This rule serves as one component of a broader detection chain for potentially unauthorized remote access.
Detects a suspicious sequence of events suggesting potential technical support scam or social engineering activity: a rapid influx of emails (email bombing) followed by an external Microsoft Teams call, and subsequently the execution of a common remote access tool on the same host within a short timeframe.
Detects the execution of the AnyDesk remote support application when initiated from a web browser (msedge.exe) or the Windows file explorer (explorer.exe). This pattern is often indicative of user-driven execution, potentially as part of a tech support scam or unauthorized remote access attempt.
Detects a sequence of events where a user is targeted by an email bombing attack, subsequently receives an external or anonymous Microsoft Teams call, and finally launches a known remote access tool (e.g., AnyDesk, TeamViewer) on the same host within a one-hour window. This pattern is consistent with social engineering campaigns designed to trick users into providing remote access to their systems.
Detects the execution of AnyDesk or its installation from common user-writable directories (Downloads or AppData), as well as scenarios where a browser (msedge.exe) initiates an AnyDesk-related download. This is a common indicator of unauthorized remote access tool deployment.
This rule detects potential Quasar RAT post-infection activity by correlating the identification of keystroke logging API usage (specifically SetWindowsHookEx, GetAsyncKeyState, or GetKeyboardState) followed by an outbound network connection from the same process identifier within a ten-minute window, indicative of remote control functionality.
Detects the deployment of NetSupport Manager (client32.exe) or related components when initiated by common scripting interpreters such as PowerShell, MSHTA, or CMD. This behavior is indicative of a ClickFix-style social engineering attack where a user is coerced into executing malicious commands to deploy remote access tools.
This rule detects potential usage of Hidden VNC (hVNC) tools by monitoring for specific command-line arguments (such as 'hvnc-input', 'hvnc-desktop', or 'HVNC_Telegram') and Windows events related to the creation or switching of desktops (e.g., 'CreateDesktop', 'SwitchDesktop'). hVNC is a common technique used by malware to establish a hidden remote desktop session for unauthorized access and control without alerting the user.
Detects the execution of NetSupport Remote Access Tool (RAT) components (client32.exe, Nskbfltr.sys, or TCCTL32.dll) from locations outside of the standard program installation directories. This behavior is often indicative of unauthorized persistence or masquerading by malware utilizing remote support software for C2.
Detects a multi-stage Telephone-Oriented Attack Delivery (TOAD) campaign. The first stage identifies phishing emails containing billing or security-themed subjects and phone numbers without links or attachments to evade automated analysis. The second stage monitors for the subsequent installation or execution of common remote-support tools (e.g., AnyDesk, TeamViewer, ScreenConnect). A final correlative rule detects these events occurring sequentially on the same host, indicating a high-confidence indicator of a successful callback phishing social-engineering attempt.
Page 8 of 42