Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects installation or update of a VM extension whose settings invoke scripts, remote support tooling, or command execution outside standard configuration management. This could indicate an adversary establishing persistence or remote access.
This rule detects the execution of known remote access tools (such as AnyDesk, TeamViewer, or RustDesk) that are spawned as child processes from common web browsers. It correlates process creation events with subsequent network connections by these tools to public IP addresses over specific ports commonly used by remote access software, within a 30-minute timeframe of the process start.
Detects a browser-downloaded installer spawning ScreenConnect or another remote management client without an established software deployment parent. This rule identifies suspicious process creation where a known installer executable, likely downloaded from a browser (indicated by paths like Downloads, Temp, or AppData), initiates a remote monitoring and management (RMM) tool such as ScreenConnect or ConnectWiseControl. This behavior can indicate an adversary establishing remote access.
Detects the execution of MassLogger RAT components where the command line contains 'masslogger', 'mass.logger', or 'logger.exe', specifically when initiated by PowerShell or a process associated with 'RemotePC'. This rule aims to identify the loading or execution phase of the MassLogger RAT.
Detects the execution of known Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Action1) from user-writable directories such as Temp, Downloads, or INetCache. Adversaries frequently utilize these legitimate remote access tools to establish persistence or command-and-control channels, often dropping them into temporary directories to avoid detection.
Detects the execution of Remote Monitoring and Management (RMM) software initiated by common Windows script interpreters. This pattern is indicative of unauthorized deployment of remote access tools, often used by adversaries to establish persistence and command-and-control channels following initial compromise.
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Lightweight remote access trojan deployed in recruiter-themed social engineering
This rule detects scenarios where a new local user account is created on a Windows system during off-hours (between 7 PM and 7 AM), followed by the execution of known remote access tools within a 30-minute window of that account creation. This combination is often indicative of unauthorized persistent access establishment.
Detects the execution of known remote access software (e.g., AnyDesk, TeamViewer, Rclone, ScreenConnect) from non-standard file paths or when launched by suspicious parent processes such as cmd.exe, powershell.exe, or script interpreters. This behavior is indicative of potential adversary usage of living-off-the-land techniques or lateral movement via third-party remote access utilities.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects WebSocket connections to the AutoGen Studio MCP control plane on ports 8080 or 8081, specifically looking for URLs containing '/api/mcp/ws/' and 'server_params=', which may indicate an attempt at Remote Code Execution (RCE) via malicious server parameters.
Detects the execution of legitimate Windows remote assistance tools (Quick Assist, MSRA) shortly after potential external collaboration activity in Microsoft Teams. This can indicate an adversary leveraging social engineering or remote access software to establish a foothold or conduct unauthorized remote support sessions.
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
Page 20 of 41