Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Detects the installation or execution of unauthorized Remote Monitoring and Management (RMM) tools such as MeshCentral, Atera, Teramind, AnyDesk, or AdaptixC2 artifacts on endpoints. It flags devices running multiple distinct RMM tools or featuring AdaptixC2.
Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects Kerberos service ticket principal name (SPN) enumeration or exposure events occurring shortly after the execution of common remote access tools (such as Quick Assist, AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, or LogMeIn) on the same device.
The following analytic detects the writing of files from known remote access software to disk within the environment.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information.
This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration, further compromise, or complete control over affected systems.
It is best to update both the remote_access_software_usage_exception.csv lookup and the remote_access_software lookup with any known or approved remote access software to reduce false positives and increase coverage.
In order to enhance performance, the detection filters for specific file names extensions / names that are used in the remote_access_software lookup.
If add additional entries, consider updating the search filters to include those file names / extensions as well, if not alread covered.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information.
This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access.
If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration, further compromise, or complete control over affected systems.
It is best to update both the remote_access_software_usage_exception.csv lookup and the remote_access_software lookup with any known or approved remote access software to reduce false positives and increase coverage.
In order to enhance performance, the detection filters for specific file names extensions / names that are used in the remote_access_software lookup.
If add additional entries, consider updating the search filters to include those file names / extensions as well, if not alread covered.
Detects the installation or service setup of unauthorized remote access tools (such as AnyDesk, TeamViewer, or ScreenConnect) followed by outbound public network connections from the same device within a one-hour window.
Detects the execution of known Remote Monitoring and Management (RMM) tools within a 30-minute window following Microsoft Teams network activity on the same device, which can be an indicator of unauthorized remote access or interactive command and control setup via remote support applications.
Correlates Microsoft Teams process activity with the subsequent launch of a remote monitoring and management (RMM) tool on the same device within 30 minutes, potentially indicating social engineering or hands-on-keyboard access following external communications.
Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.
Detects the presence of Tailscale binaries (tailscale.exe, tailscaled.exe) on a device within 24 hours of other campaign-specific toolkit components such as kitanai.exe, nandemo.exe, ufw.exe, or upd-ms.bat, indicating potential unauthorized remote access setup.
Detects the execution of unapproved Remote Monitoring and Management (RMM) software tools followed by subsequent outbound public IP network activity from the same process on the same device, indicating an active remote session.
Detects the execution of Remote Monitoring and Management (RMM) tools followed closely (within 1 day) by potential data exfiltration activity using tools like WinSCP or Rclone, or connections to cloud storage providers (OneDrive, Google Drive) from the same device.
Detects the correlation of remote execution tools (such as PsExec, WinRM, or specific PowerShell remote execution commands) with RDP or ScreenConnect remote management activity on the same device within a one-hour window, potentially indicating lateral movement or unauthorized remote control.
Detects a sequence where a device exhibits Remote Monitoring and Management (RMM) tool execution followed by high-volume outbound network connections to consumer cloud storage services (such as OneDrive or Google Drive) from the same device, potentially indicating data exfiltration via RMM.
Detects a sequence where PowerShell or PWSH executes a web download referencing an .mp4 file using download cmdlets, followed within 1 hour by the execution of NetSupport Manager components (client32.exe or pcictlui.exe) from a user-writable path.
Detects the execution of NetSupport Manager client binaries (client32.exe or pcictlui.exe) from user-writable directories such as AppData, ProgramData, or Public folders, optionally spawned by script loaders or command interpreters.
The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
The following analytic detects the execution of known remote access software within the environment.
It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
Page 1 of 41