Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61 detections
Filters
Last updated
All Time
Detection languages
26
12
6
4
4
Contributors
20
10
9
7
4
Categories
15
15
14
10
9
Platforms
51
4
4
2
1
Products / Services
21
16
4
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
1
IDS Protocols
2
1
1
Detects the loading of avicap32.dll by non-conferencing processes executing from user-writable directories such as AppData or Temp. This behavior is indicative of Remcos RAT or similar remote access trojans attempting to covertly capture audio or video using Windows API modules commonly used for media capture.
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
Detects the presence of Remcos RAT by correlating a specific mutex (Remcos_Mutex_Inj) indicative of active malicious processes with an outbound network connection to a known command-and-control (C2) IP address (62.102.148.212) on port 37393. This combination is characteristic of Remcos RAT operations used for unauthorized audio and webcam surveillance.
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
Detects unauthorized access to webcam for video surveillance collection
This rule detects a high volume of Real-time Transport Protocol (RTP) video stream traffic originating from the home network and destined for external servers. Specifically, it triggers an alert if more than 100 UDP packets with a data size greater than 1000 bytes are observed from a single source IP address within a 10-second window. This pattern could indicate unauthorized video streaming or data exfiltration.
This rule detects the upload of a potential screen recording file to a remote server over HTTP. It specifically looks for HTTP POST requests where the URI contains the string "video" (case-insensitive) and the file data contains the byte sequence "|00 00 00|" within the first 4 bytes, indicating a common video file header. Additionally, the file size must be greater than 500KB, which helps to filter out small, non-video files.
This rule detects the exfiltration of a webcam video stream over HTTP POST. It specifically looks for HTTP POST requests containing file data, where the data starts with the hexadecimal sequence '52 49 46 46' (which corresponds to 'RIFF', a common header for multimedia file formats like AVI and WAV) and has a size greater than 100,000 bytes. This combination suggests a large multimedia file, potentially a video, being uploaded.
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
Detects RAT command structure
Detects scenarios where an attacker would attempt to shadow a RDP session.
Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.
Detects scenarios where an attacker has initiated a RDP shadow session.
KQL Query from file: Tracking Proton66 Activity with KQL
Detects Processes accessing the camera and microphone from suspicious folder
Detects Processes accessing the camera and microphone from suspicious folder
This rule detects suspicious access to the camera and microphone by processes running from unusual or temporary locations. It monitors registry events related to the CapabilityAccessManager ConsentStore for non-packaged applications. Specifically, it looks for modifications to registry keys that indicate access to 'microphone' or 'webcam' from paths like temporary folders, the Recycle Bin, or public user directories. This behavior can be indicative of malware attempting to record audio or video without user consent.
This rule detects attempts by processes to access the microphone and webcam by monitoring specific registry key access events. It looks for EventIDs 4657, 4656, or 4663 associated with registry paths related to the Windows Capability Access Manager's consent store for microphone and webcam access by non-packaged applications. This can indicate an adversary attempting to collect audio or video from the endpoint.
Detects Processes accessing the camera and microphone from suspicious folder
Page 3 of 3