Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
296 detections
Filters
Last updated
All Time
Detection languages
99
93
29
27
18
Contributors
58
47
44
26
18
Categories
89
82
78
61
59
Platforms
262
35
10
9
2
Products / Services
97
56
54
33
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
2
1
IDS Classtypes
11
7
5
3
1
IDS Protocols
20
7
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects Remote Interactive RDP logon events targeting systems identified as servers or critical infrastructure, using the DeviceLogonEvents data source.
Detects the execution of known Active Directory enumeration scripts or commands via PowerShell shortly after a Remote Desktop (RDP) login session is established on a device. This pattern is indicative of an attacker who has gained remote access and is immediately performing discovery activities.
Detects inbound Remote Desktop Protocol (RDP) connections targeting internal Windows devices from public IP addresses. This rule identifies potential unauthorized remote access, brute-force activity, or the exposure of RDP services to the public internet.
This rule identifies accounts, hosts, and remote IP addresses associated with a high volume of Remote Desktop Protocol (RDP) logon activity, which may indicate brute-force attempts, credential stuffing, or anomalous remote access behavior.
Detects anomalous internal lateral movement activity where the Remote Desktop client (mstsc.exe) establishes network connections to multiple distinct internal destinations within a short window, potentially indicating an attacker traversing the network.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
This rule detects successful Remote Desktop Protocol (RDP) logons (Event ID 4624 with Logon Type 10) and the execution of the Remote Desktop Connection client (mstsc.exe). It monitors for signs of remote interactive access to windows endpoints, which can indicate unauthorized access or legitimate administrative activity.
Detects a single source IP address initiating Remote Desktop Protocol (Logon Type 10) connections to three or more distinct computer destinations within a 10-minute window. This behavior is indicative of lateral movement or internal network scanning activity.
This rule monitors for RDP connections (Windows Event ID 4624 Logon Type 10) and RDP client launches (mstsc.exe) within an environment. It enriches these events by checking against a baseline of historically observed source-to-destination host pairs. A new or previously unseen connection pair triggers an alert, helping to identify potential lateral movement.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
Detects a single user account authenticating via RDP (Logon Type 10) to three or more distinct target hosts within a 15-minute window, which is often indicative of an adversary performing lateral movement using compromised credentials.
This rule detects potential lateral movement by monitoring for successful Remote Desktop Protocol (RDP) logons (Event ID 4624, Logon Type 10) occurring directly between workstations, excluding connections where the destination computer name indicates a typical server or infrastructure naming convention (e.g., ends with $).
This rule detects when a single account initiates 5 or more successful Remote Desktop Protocol (RDP) connections within a one-hour window. This behavior can be indicative of an adversary attempting to gain widespread access within a network, potentially through credential stuffing, brute-force attacks, or lateral movement using compromised credentials.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
This rule detects interactive RDP logons (Logon Type 10) on Windows systems. While RDP is a legitimate remote administration tool, it is frequently abused by adversaries following credential theft to move laterally within a network.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects Remote Desktop (RDP) logon events (LogonType 10) initiated by common privileged or service-oriented accounts such as administrator, backup_EA, or backup_DA. This behavior may indicate unauthorized remote access or credential abuse using highly privileged accounts.
Page 4 of 15