Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
23
11
6
4
3
Contributors
22
11
7
5
3
Categories
26
18
9
7
6
Platforms
48
6
2
Products / Services
22
7
4
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly.
This analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer, as identified by Cisco Secure Firewall Application Detectors. It leverages Cisco Secure Firewall Threat Defense Connection Events. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects the installation of the AnyDesk remote access software service. This could indicate abuse if AnyDesk is not legitimately used within the environment. The rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, where the service name or image path contains 'AnyDesk' and the service name also contains 'Service'.
This rule detects unusual parent or child processes associated with 'ImagingDevices.exe' (Windows Contacts). Specifically, it looks for 'ImagingDevices.exe' being spawned by 'WmiPrvSE.exe', 'svchost.exe', or 'dllhost.exe', or for 'ImagingDevices.exe' spawning any child process. This activity has been observed in connection with Bumblebee malware operations, where adversaries might abuse legitimate processes for execution or defense evasion.
This rule detects potential remote thread injection activities associated with the Bumblebee malware. Specifically, it looks for instances where 'wabmig.exe', 'wab.exe', or 'ImagingDevices.exe' create a remote thread in 'rundll32.exe'. This behavior is indicative of how Bumblebee operates to execute its malicious payload.
Detects the use of 7-Zip utilities (7z.exe, 7za.exe, and 7zr.exe) to extract password-protected compressed files. This activity can be indicative of an adversary decompressing sensitive data or malware that was archived with a password, potentially as part of collection or staging activities.
Detects the execution of 'rundll32.exe' when its parent process is 'explorer.exe'. This behavior has been observed in variants of the Raspberry Robin malware, as initially reported by Red Canary. The rule includes filters to reduce false positives from legitimate Windows operations, such as volume control.
This rule detects unusual parent or child processes associated with `wab.exe` (Windows Contacts) and `wabmig.exe` (Microsoft Address Book Import Tool). These processes are typically not involved in spawning other processes or being spawned by unusual parents. The rule specifically looks for `wab.exe` or `wabmig.exe` being spawned by `WmiPrvSE.exe`, `svchost.exe`, or `dllhost.exe`, or if `wab.exe` or `wabmig.exe` themselves spawn any child processes. This behavior has been observed in connection with Bumblebee loader activity, indicating potential malicious execution or defense evasion.
Detects the execution of 'wab.exe' (Windows Contacts) and 'wabmig.exe' (Microsoft Address Book Import Tool) when they are launched from non-default, suspicious locations. This behavior has been observed in campaigns involving the Bumblebee loader, where these legitimate Windows executables are abused for malicious purposes, often as part of defense evasion or execution tactics.
This rule detects the MountLocker ransomware based on specific byte patterns found within its executable code. The patterns are associated with functions responsible for encrypting files and finding files to encrypt, which are core functionalities of ransomware.
Page 3 of 3