Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Identifies an alternative execution path where the Fake Tech Support lure convinces the user to install legitimate remote access tools (LogMeIn, TeamViewer, AnyDesk) which the attacker hijacks. This rule specifically looks for the execution of these tools with the '--kiosk' command-line argument.
Detects installation of common remote management products from Downloads, Temp, AppData, Desktop, or Public user paths with silent installation options. This activity is often associated with adversaries establishing persistence or gaining remote access.
Detects the execution of known remote access tools (e.g., AnyDesk, TeamViewer, RemotePC, IDriveRemotePC) from non-standard parent processes. This helps identify unauthorized or potentially malicious use of remote control software that bypasses standard application deployment or management processes.
Detects the use of two or more distinct remote access products by the same user on the same device within a one-hour window. This could indicate suspicious activity, such as an attacker attempting to maintain persistence or using multiple tools for different stages of an attack, or a legitimate user having multiple remote access tools installed and running concurrently.
Detects a MeshCentral agent launched from temporary directories or Oracle PeopleSoft application paths. This activity is often associated with remote access software used by adversaries.
Detects TeamViewer being used for unauthorized persistent remote access
Detects TeamViewer being used for unauthorized persistent remote access
Detects the execution of MassLogger RAT components where the command line contains 'masslogger', 'mass.logger', or 'logger.exe', specifically when initiated by PowerShell or a process associated with 'RemotePC'. This rule aims to identify the loading or execution phase of the MassLogger RAT.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule looks for the creation of a file named 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' or the execution of 'meshagent' or 'meshcentral' processes from suspicious directories or initiated by common shell/download utilities.
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
Detects the execution of MeshCentral's command-line utility via Node.js, a technique observed in ShinyHunters attacks against Oracle PeopleSoft servers.
This rule links downloading a Windows installer from a public GitHub repo with a Deno remote-access chain starting afterward. Trojanised releases abuse trust in open source. Only install signed builds from official vendors. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the staging of remote management tools (AnyDesk, RustDesk, ScreenConnect, TeamViewer) on a device, where the initiating process's command line contains keywords related to business lures (invoice, payroll, tax, HR, resume, quotation). This pattern is indicative of TA4922 activity, where attackers use business-themed social engineering to gain initial access and then deploy RMM tools for persistent access before deploying ransomware.
Detects a remote access utility spawning command shells or script interpreters, indicating hands-on-keyboard activity through an RMM session.
Detects connections to default C2 ports used by Metasploit and common RAT frameworks
This detection identifies when an email that contains a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
Detects download of remote access tools following vishing contact
Detects outbound HTTPS traffic to known malicious infrastructure (supp0v3[.]com), used across all campaign waves for credential theft and remote access.
ClickFix RAT C2 Connection
Cortex XDR
Detects network traffic to the primary command and control (C2) IP address (104.207.131.216) over port 16443, which is used by the ClickFix Python Remote Access Trojan (RAT) for malicious communication.
Detects abuse of trusted MSP remote management tools for initial access
Detects the execution of Chrome Remote Desktop (remoting_host.exe) with daemon flags, which NightSpire ransomware operators use to establish persistence.
Page 22 of 41