Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Detects the execution of AnyDesk using command line flags to run as a service or control utility, which is indicative of NightSpire ransomware persistence mechanisms.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
This rule detects SSH connections initiated by 'ssh.exe' that involve remote port forwarding ('-R' flag) or potential SSH tunneling (command line containing both '@' and ':'). This behavior can be indicative of adversaries establishing covert communication channels or maintaining persistence.
This rule detects TCP network connections originating from the internal network ($HOME_NET) to any external destination on port 1337. The detection is specifically for the initial SYN packet of a TCP handshake (flags:S) and is categorized as 'trojan-activity'. Port 1337 is commonly associated with Remote Access Trojans (RATs) for Command and Control (C2) communications, aligning with MITRE ATT&CK technique T1219.
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Process Creation of LOLRMM Tools
Gravwell
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
Detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement.
Detects the installation and execution of DWAgent (dwagsvc.exe) from the C:\ProgramData directory, specifically looking for service installation and startup commands. Threat actors like Kimsuky are known to use legitimate RMM tools like DWAgent to maintain persistent remote access while blending in with normal administrative activities.
Detects the execution of AnyDesk with flags intended to install it as a persistent service. Legitimate remote monitoring and management (RMM) tools like AnyDesk are increasingly weaponized by threat actors to establish robust, stealthy persistence that evades standard malware detection.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
Detects command lines associated with installing AnyDesk silently to run on startup or setting an unattended access password. Affiliates of The Gentlemen ransomware and other threat actors use this as a persistent fallback remote access channel.
Detects the command line execution of VS Code initiating a tunnel using a GitHub provider. This technique has been observed to be used by threat actors like Tropic Trooper to establish interactive remote access while blending in with legitimate developer activity.
Detects the command line execution of VS Code initiating a remote tunnel. Threat actors like Tropic Trooper use this technique (e.g., via GitHub or Microsoft providers) to establish interactive remote access while blending in with legitimate developer activity.
Identifies when the ScreenMeet.Support.exe RMM tool is downloaded on a host or initiates network connections. This rule detects file creation events for 'ScreenMeet.Support.exe' and network connections made by processes with 'ScreenMeet.Support.exe' as the initiating process filename.
Detects the disabling of the Windows Firewall across all profiles using command-line tools such as netsh or PowerShell. This technique is commonly used by threat actors and ransomware affiliates, like The Gentlemen RaaS, to evade defenses and facilitate unrestricted lateral movement.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
Page 23 of 41