Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects potential TaskWeaver malware loader activity by monitoring for suspicious process execution patterns within a SimpleHelp Remote Monitoring and Management (RMM) context. Specifically, it triggers when a SimpleHelp process launches common scripting interpreters (wscript.exe, cscript.exe, node.exe, powershell.exe, cmd.exe) or when a file named 'jquery.js', a known lure filename used by TaskWeaver, is executed.
This rule monitors for the execution of common remote access and support tools (AnyDesk, TeamViewer, ScreenConnect, QuickAssist) that originate from suspicious file paths (e.g., Temp, AppData, Downloads) or are launched with silent installation flags, or appear to be installed via msiexec by non-standard parent processes. These behaviors are common indicators of adversaries attempting to establish unauthorized persistent remote access or deploying remote support tools as part of a post-exploitation activity.
Detects the unauthorized installation and service configuration of OpenSSH Server on Windows workstations. This technique is used to establish persistent, redundant backdoor access, as observed in Operation Poisson, where adversaries deploy it to maintain access alongside other tools like Tailscale.
Detects the execution of known remote access or remote support tools (AnyDesk, ScreenConnect, QuickAssist, or Atera) when the parent process is Microsoft Teams. This behavior may indicate an attempt by an adversary to leverage legitimate remote access software for unauthorized access, potentially following an initial compromise via social engineering or spear-phishing over Teams.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
Detects the execution of ScreenConnect.ClientService.exe with command line arguments containing 'servermanagemen' or 'Microsoft Update Service'. This pattern is often associated with the use of ConnectWise (ScreenConnect) remote access software, which can be leveraged for legitimate administration or malicious remote control.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
This rule detects the execution of Microsoft Quick Assist (msra.exe or quickassist.exe) on endpoints. It elevates the risk score if the event is preceded by Microsoft Teams activity within 30 minutes or occurs on a host exhibiting high volumes of email traffic, which may indicate remote access tool abuse following a social engineering or phishing attempt.
Detects the execution of known remote access and monitoring software (RMM/RAT) when launched as a child process of common web browsers or email clients. This behavioral pattern is frequently observed in phishing attacks where users are tricked into downloading and executing remote support tools, a technique often associated with the Luna Moth (Silent Ransom Group) campaign.
Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.
Detects the execution, installation, or configuration of Tailscale, a legitimate remote access tool. The rule monitors for common command-line arguments like '--authkey' and 'up', service-related activity, and execution from non-standard file paths. It flags instances where Tailscale is spawned by common script interpreters or command shells, which is a common indicator of unauthorized remote access or C2 implant activity.
Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.
This rule detects DNS queries originating from the internal network towards the domain 'direct-download.giize.com', which has been associated with the unauthorized distribution of the ScreenConnect remote access tool. This activity is indicative of an attempt to download potentially malicious or unauthorized remote administration software.
This rule detects the execution of Quick Assist (quickassist.exe) or Microsoft Remote Assistance (msra.exe) in scenarios where the parent process, causality chain, or command line includes references to Microsoft Teams. This behavior is indicative of social engineering attempts where attackers impersonate IT support via Teams to induce users to launch remote access tools, a tactic observed in campaigns like BlackBasta.
Detects the execution of known remote access tools (e.g., AnyDesk, SyncFuture) or processes originating from common user-writable directories (AppData, Temp, Local) that subsequently spawn other processes within these same user-writable directories. This pattern is commonly observed in malware staging or the misuse of remote support tools for unauthorized access.
Detects the execution of remote monitoring and management (RMM) binaries AnyDesk or SyncFuture when launched by suspicious parent processes commonly associated with phishing delivery chains (e.g., mshta, wscript, cmd, powershell), or when executed from user-writable directories like Temp or AppData, which is a common pattern for persistent remote access abuse.
This rule detects the execution of known remote access tools (such as AnyDesk, TeamViewer, or RustDesk) that are spawned as child processes from common web browsers. It correlates process creation events with subsequent network connections by these tools to public IP addresses over specific ports commonly used by remote access software, within a 30-minute timeframe of the process start.
This rule detects the execution of common command-line interface tools (such as PowerShell, cmd, wscript, and certutil) spawned by the SimpleHelp remote support binary ('simplehelp.exe'). It also monitors for specific network connections associated with the SimpleHelp infrastructure (IP 96.126.130.126 on port 58942) that may indicate remote support activity or misuse of the platform.
Detects the execution of MeshCentral agent commands, specifically the 'RunCommand' feature, which is often used by adversaries for post-compromise remote command execution and payload staging. This rule monitors both endpoint process activity and system logs for command-line arguments involving meshctrl.js and RunCommand.
RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Detects the installation and operation of the RustDesk remote access tool as a persistent Windows service. This behavior has been identified in the Akira ransomware intrusion chain where adversaries utilize remote access tools for post-compromise persistence and control. The rules monitor for service creation via command-line utilities (sc.exe, PowerShell), registry modifications related to service configurations, and Windows Service Control Manager events (Event ID 7045) that register RustDesk as a persistent system service.
Page 17 of 41