Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule identifies the MeshCentral agent by process image name and common deployment paths or by its execution via common shell/download utilities. It also looks for the creation of the ransom note file 'README-IF-YOU-SEE-THIS-YOU-VE-BEEN-HACKED.TXT'.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
Detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group.
This rule detects the use of PowerShell or Command Prompt to execute commands related to Remote Monitoring and Management (RMM) software or remote management tools such as IDrive or TeamViewer. It specifically looks for command-line arguments involving RMM-related keywords combined with execution flags or piping operators, which is a common pattern for automating the deployment, configuration, or malicious use of these remote access tools.
Detects the execution of Remote Monitoring and Management (RMM) software initiated by common Windows script interpreters. This pattern is indicative of unauthorized deployment of remote access tools, often used by adversaries to establish persistence and command-and-control channels following initial compromise.
Detects remote support software being added to common user or machine Run and RunOnce registry persistence locations. This rule specifically looks for modifications or creations within the 'Run' and 'RunOnce' registry keys that contain strings associated with known remote access or management tools such as AnyDesk, Bomgar, BeyondTrust, Zoho, ScreenConnect, Splashtop, Atera, SuperOps, and TeamViewer. This activity could indicate an attacker establishing persistence on a compromised system.
Detects the execution of RustDesk, a legitimate remote access tool, specifically when running with service or tray command-line arguments. This activity may indicate the installation of remote management capabilities by an adversary or authorized administrative activity.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
This rule detects the execution and network activity of known Remote Monitoring and Management (RMM) tools such as AnyDesk, TeamViewer, and ScreenConnect. It assigns a risk score based on whether the activity occurs outside of defined business hours (8 AM - 6 PM) and whether the tool is initiating an outbound connection on port 443, a common pattern for C2 communication.
Detects remote management software launched from an existing RDP session, indicating nested remote access or pivoting.
Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects the execution of known remote access tools (e.g., AnyDesk, TeamViewer, RemotePC, IDriveRemotePC) from non-standard parent processes. This helps identify unauthorized or potentially malicious use of remote control software that bypasses standard application deployment or management processes.
Detects the deployment of MeshCentral remote management agents and associated outbound communication to suspicious C2 infrastructure, identified in environments compromised by ShinyHunters. This rule monitors for specific process execution patterns involving meshctrl.js and meshagent, alongside network connections to known C2 domains and IP addresses.
Identifies the execution of MeshCentral for remote command execution.
This rule identifies the execution of MeshCentral for remote command execution, specifically looking for command-line arguments containing 'meshctrl.js' and 'RunCommand'. This activity has been observed in attacks such as those by ShinyHunters to stage payloads on compromised Oracle PeopleSoft servers.
This rule identifies the execution of MeshCentral for remote command execution by looking for specific command-line arguments. It specifically targets instances where 'meshctrl.js' and 'RunCommand' are present in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters.
Correlates a downloaded remote support installer with execution of the same file on the endpoint shortly afterwards. This rule identifies instances where a known remote access tool installer (e.g., AnyDesk, Bomgar, BeyondTrust) is downloaded and then executed on the same device within a 15-minute window, which could indicate an attacker establishing remote access.
Detects when collaboration applications (like Microsoft Teams or Zoom) or web browsers launch remote support utilities. This activity may indicate social engineering tactics during a screen sharing session, where an attacker convinces a user to install or run remote access software.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Page 21 of 41