Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects the execution of known Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Action1) from user-writable directories such as Temp, Downloads, or INetCache. Adversaries frequently utilize these legitimate remote access tools to establish persistence or command-and-control channels, often dropping them into temporary directories to avoid detection.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
This rule detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement. The rule categorizes the detected tools into 'Tunneling' or 'RMM'.
Detects the execution of known remote access and remote management tools (e.g., TeamViewer, AnyDesk) where the process was initiated by a web browser, suggesting potential drive-by downloads or social engineering attacks involving remote access software.
This rule detects scenarios where a new local user account is created on a Windows system during off-hours (between 7 PM and 7 AM), followed by the execution of known remote access tools within a 30-minute window of that account creation. This combination is often indicative of unauthorized persistent access establishment.
Detects the execution of MeshCentral agent commands, specifically the 'RunCommand' functionality, which can be used to stage payloads or execute unauthorized commands on compromised systems. This detection monitors both process execution events on endpoints and generic syslog data.
This rule detects the execution of RMM (Remote Monitoring and Management) installers (Atera or SimpleHelp) via msiexec.exe or setup.exe when launched from directories commonly used for downloads (Temp/Downloads) and originating from web browsers or Microsoft Office applications. This behavior is indicative of a potential drive-by download or phishing attack aimed at installing unauthorized remote access software.
Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.
Identifies the execution of MeshCentral for remote command execution, specifically looking for 'meshctrl.js RunCommand' in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters for staging payloads.
Detects signs of post-infection activity from the Amadey malware, specifically the unauthorized enabling of Remote Desktop Protocol (RDP) via registry modifications, the use of tscon.exe for session hijacking, unusual execution of RDP-related binaries (mstsc.exe, rdpclip.exe), and the deployment of legitimate remote access tools like AnyDesk or TeamViewer for lateral movement.
Detects the execution of the NetSupport Manager remote access tool (client32.exe) when spawned by web browsers or script interpreters such as PowerShell or MSHTA. This behavioral pattern is frequently associated with malicious delivery chains including ClickFix and CastleLoader, where users are social engineered into downloading or executing suspicious payloads.
This rule detects potentially malicious activity involving the AnyDesk remote access tool by monitoring for abnormal child process spawning, such as command shells (cmd, powershell, etc.), and suspicious DLL loading behavior from non-standard directories. These activities are common indicators of an adversary using remote desktop software for command and control or post-exploitation execution.
Detects instances where the SimpleHelp RMM agent process initiates a command interpreter or scripting process. This behavior is often indicative of post-exploitation activity, specifically unauthorized script or command execution delivered via a remote support session.
This rule monitors for the execution of the RustDesk remote access tool and specifically tracks any child processes spawned by it. Detecting child processes spawned by legitimate remote access tools like RustDesk is a high-fidelity signal for identifying post-compromise activity, such as command execution or lateral movement.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects the installation of RustDesk as a Windows service, identified via System event log ID 7045. Adversaries may abuse this remote access tool to maintain persistent, unauthorized remote access to compromised systems, as observed in ransomware intrusions.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
Detects instances where the RustDesk remote access tool spawns suspicious child processes, such as command shells, scripting interpreters, or system administrative utilities. This pattern is often indicative of an adversary abusing legitimate remote access software to execute arbitrary commands, perform discovery, or maintain interactive control over a host.
Detects potential unauthorized remote control activity via RustDesk, specifically identifying sessions that spawn child processes (e.g., cmd.exe, powershell.exe) or exhibit behavior indicative of bypassing permission constraints on RustDesk processes not signed by the official publisher.
Detects potentially unauthorized or suspicious usage of the RustDesk remote access tool. The rule monitors for connections from new peer IDs, the spawning of command shells (cmd.exe or powershell.exe) by the RustDesk process, and the writing of executable or sensitive file types by RustDesk to non-standard directories.
Page 19 of 41