Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects process creation for common RMM tools (AnyDesk, Bomgar/BeyondTrust, TeamViewer).
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
Detects the execution of anydesk.exe from user-writable directories such as AppData, Temp, Downloads, or Music. This behavior is indicative of potential unauthorized use of remote access software, which may be deployed by an adversary for persistence or establishing a command and control channel outside of standard administrative tools.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
This rule detects unauthorized or suspicious access to the Komari remote administration panel over unencrypted HTTP. Detecting such access is critical as it indicates potential management interface exposure or unauthorized administrative activity within the network.
Detects the execution of the legitimate AnyDesk remote access tool when it is launched from a non-standard file path containing '\music\', which may indicate an attempt to hide the executable in a less suspicious directory.
Detects the creation of a Windows service associated with the AnyDesk remote access application using the sc.exe utility. This behavior often indicates the unauthorized installation or persistence setup of a remote access tool.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects outbound network traffic from internal hosts to known IP addresses associated with AnyDesk relay infrastructure, which may indicate unauthorized use of remote access tools.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.
Detects outbound network traffic consistent with CrySome RAT Command and Control (C2) communication, including direct connections to a known hardcoded IP address on port 5555 and the observation of the '##CRYCFG##' configuration marker within the TCP stream.
Detects the execution of known Remote Monitoring and Management (RMM) tools (AnyDesk, SyncFuture, QuickAssist, etc.) when launched by suspicious or untrusted parent processes. Additionally monitors for non-standard installation paths for AnyDesk and the creation of persistence registry keys for these RMM tools.
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
Detects the execution of Microsoft Quick Assist (or related Remote Desktop clients) shortly after activity from Microsoft Teams. This pattern is consistent with social engineering tactics where an attacker impersonates IT personnel over a Teams call to persuade a victim to provide remote access to their workstation.
Detects potential exploitation of RustDesk remote access software, focusing on unauthorized process execution from RustDesk-related binaries (including session relay and rendezvous components) and the presence of documented proof-of-concept (PoC) artifacts associated with session permission bypass vulnerabilities.
Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.
Detects instances where Microsoft Teams or its associated process spawns remote assistance utilities such as Quick Assist, Microsoft Remote Assistance (msra), or Remote Desktop Connection Manager (msrdcw). This behavior may indicate an attacker abusing legitimate remote access software for command and control or unauthorized remote control.
Detects the execution of known remote access or remote support tools (AnyDesk, ScreenConnect, QuickAssist, or Atera) when the parent process is Microsoft Teams. This behavior may indicate an attempt by an adversary to leverage legitimate remote access software for unauthorized access, potentially following an initial compromise via social engineering or spear-phishing over Teams.
Detects network activity over port 1313 containing Socket.IO payloads with keywords 'control' and 'escape', indicative of a command and control or remote access channel often associated with interactive shells or administrative backdoors.
Page 16 of 41