Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.
Detects network traffic containing configuration parameters associated with RatHat Android malware (FrpsAddr, FrpsPort, FrpsToken), indicating an attempt to establish a reverse tunnel to a Command and Control server for remote access or proxying.
Detects the execution of known Remote Monitoring and Management (RMM) agent installers or binaries via PowerShell. This activity may indicate an attempt to establish unauthorized remote access to a system, a common technique used by threat actors to maintain persistence or conduct post-compromise activities.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects outbound TLS traffic to known remote access and management software domains (e.g., ScreenConnect, AnyDesk, TeamViewer), which are frequently abused by adversaries for establishing Command and Control (C2) channels.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
Detects the execution of the Cloudflare Tunnel client (cloudflared.exe) on Windows endpoints by monitoring process command line arguments, such as 'tunnel', 'run', or 'proxy-dns'. This tool can be used to establish unauthorized remote access tunnels, potentially bypassing firewall configurations.
Detects the execution of known remote monitoring and management (RMM) software often abused by threat actors following social engineering attempts, such as helpdesk impersonation, to establish persistence and remote access prior to deploying ransomware.
Detects the execution or deployment of MeshAgent, a legitimate Remote Monitoring and Management (RMM) tool, which is often abused by adversaries to maintain persistence and command-and-control access. The rule monitors for common process names such as meshagent.exe and mvtcs.exe, as well as command-line arguments containing 'meshagent'.
Detects a successful VPN authentication event followed within 30 minutes by the execution of the MeshAgent RMM tool or its renamed variant mvtcs.exe. This behavioral pattern is associated with initial access via compromised VPN credentials followed by the deployment of remote monitoring and management (RMM) tools for persistence and command and control.
Detects the execution of MeshAgent, a remote monitoring and management (RMM) tool, by monitoring for its associated process names (meshagent.exe, mvtcs.exe) or command lines containing the string 'MeshAgent'. Adversaries often abuse such legitimate remote access tools to establish persistent command and control channels or to perform unauthorized administrative activities.
Detects the execution of 'famitrf2.exe' when it is launched as a child process of 'rserver3.exe' from the specific path 'C:\intel\rserver\rserver3.exe'. This pattern is highly indicative of Remote Administrator (RAdmin) software activity, which can be leveraged for legitimate remote management or malicious remote access.
Detects the installation or execution of known remote access tools (RMM) from suspicious parent processes (browsers, archives) or from user-writable directories (Temp, Downloads). This behavior is characteristic of initial access and staging activities performed by ransomware operators or Initial Access Brokers (IABs). The rule excludes known IT-managed deployment paths and signed binaries used by the organization.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network handshake patterns associated with the Fast Reverse Proxy (FRP) client, specifically identifying outbound traffic containing identifiers used in common FRP reverse tunnel configurations. This behavior is indicative of unauthorized remote access tools or tunneling software establishing a connection to an external command-and-control server.
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
Page 12 of 41