Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects the execution of known Remote Monitoring and Management (RMM) or remote access tools on devices where they have not been observed within the previous 90-day baseline (excluding the most recent 7 days). This pattern is often indicative of an adversary introducing unauthorized remote access capabilities for persistence or lateral movement.
This rule detects the execution of QuickAssist.exe or RemSupp.exe on a host where Microsoft Teams has also been executed within the last day. This pattern may indicate the use of built-in remote support tools in conjunction with communication platforms, potentially for unauthorized remote access or suspicious remote assistance activities.
Detects the SMOKE#SCREEN loader.cs technique of inserting a ~180 second delay between ScreenConnect/RMM MSI installation and the resulting service start, deliberately used to break EDR/SIEM correlation windows.
Detects Quick Assist (msra.exe/quickassist.exe) being launched on a device within a short window after the same user signed into Microsoft Teams, consistent with UNC6692's vishing tradecraft where actors impersonate internal IT support over Teams and coerce victims into granting remote access via Quick Assist to deploy the Edgecution malware suite.
Detects unauthorized remote access sessions within N-able N-central by monitoring the Windows Application log for events indicating usage of the default 'MSP Support' account or source IP addresses associated with active exploitation of CVE-2026-18577.
Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Identifies suspicious child process relationships spawning from known abused RMM tools. Reconstructs the process tree identifying first the RMM tool, a malicious command-line tool child ie. CMD or PowerShell, and subsequently identifies a suspicious child process from this command line tool. Ransomware operators and affiliates follow approaches like this once access is gained via a legitimate remote access tool. Tune and/or add tools as needed; this is far from a complete list.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
These are extracted IoCs from a QuimaRAT sample I tore apart on my personal blog, found in the resources linked below. This is just one of many samples, so while it is certainly not all encompassing pertaining to all QuimaRAT activity, it does a great job serving as a starting point. As you will read in my analysis, QuimaRAT relies on a config file created that allows for many parameters to be changed. I did my best to focus on high-fidelity IoCs and not rely on any easily modified values in the configuration file.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Page 15 of 41