Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects the execution of Remote Monitoring and Management (RMM) tools by service accounts. RMM tools are legitimate software used for IT administration, but their use by service accounts can be indicative of malicious activity, such as an adversary maintaining persistence or performing lateral movement using compromised credentials. The rule identifies processes whose filenames match a predefined list of RMM tool executables or process names and are executed by accounts identified as service accounts based on common naming patterns.
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
This rule detects the creation, writing, or renaming of specific files associated with the compromised Axios npm package versions 1.14.1 and 0.30.4. Upon installation, the postinstall script of these compromised packages deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. The rule specifically looks for file paths indicative of these dropper activities across different operating systems.
Detects outbound HTTP POST requests using a specific, hardcoded Internet Explorer 8 User-Agent string over a specific port. This combination is highly indicative of the cross-platform RAT deployed via the compromised Axios npm packages.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
Detects the creation of known malicious Remote Access Trojan (RAT) file artifacts on Windows, Linux, and macOS systems. These artifacts are associated with the plain-crypto-js@4.2.1 NPM package supply chain compromise, which dropped RAT payloads via a postinstall script. Specifically, it looks for 'wt.exe' in '%PROGRAMDATA%' on Windows, 'ld.py' in '/tmp/' on Linux, and 'com.apple.act.mond' in '/Library/Caches/' on macOS.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
Detects network connections to known Command and Control (C2) infrastructure associated with the compromised axios NPM package, which was found to drop a Remote Access Trojan (RAT). The rule specifically looks for connections to the IP address 142.11.206.73 or DNS queries for 'sfrclak.com'.
This rule detects the execution or presence of files related to the Xeox Remote Monitoring and Management (RMM) tool. It specifically looks for process creation events where the image file name, original file name, or parent base file name contains 'xeox_' or 'xeox-', or where the image file path includes '\xeox\'. This helps identify the initial execution or persistence mechanisms of the Xeox RMM.
This rule detects the execution of processes related to 'Netbird', a peer-to-peer VPN solution that can also be used for remote access and management. It specifically looks for 'netbird' in the image file name, original file name, or parent base file name of a process on Windows platforms. Detection of this activity could indicate the legitimate use of Netbird for remote access or, in a malicious context, the deployment of a remote monitoring and management (RMM) tool by an adversary.
Detects execution of Velociraptor which may indicate threat actor using legitimate EDR tool for malicious C2
Detects the execution of legitimate Remote Monitoring and Management (RMM) tools, such as AnyDesk, ScreenConnect, OptiTuneAgent, and SplashtopStreamer, when initiated from non-standard directories (outside 'C:\Program Files') or by command-line shells (powershell.exe, cmd.exe, wscript.exe, cscript.exe). This behavior is often abused by threat actors, including groups like Chaos RaaS, for persistence and remote access.
The rule detects VNC (Virtual Network Computing) application usage on Windows systems, looking for specific indicators in conjunction.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
Detects execution of AnyDesk on Windows endpoints. Adversaries may use legitimate remote access tools to obtain interactive access and to maintain persistence after initial compromise.
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
This rule detects the presence of specific mutex names associated with CastleRAT malware activity. The detection is based on a predefined list of unique mutex strings that CastleRAT is known to use for process synchronization or to indicate its presence on a system. The rule triggers if any of these mutex names are observed, indicating a high likelihood of CastleRAT infection.
This rule detects the creation of specific mutexes known to be associated with Dark Crystal RAT (Remote Access Trojan) activity. The rule looks for two distinct mutex names: 'DCR_MUTEX-<20_random_alphanumeric_characters>' and 'DcRatMutex_qwqdanchun'. The presence of these mutexes indicates a high likelihood of Dark Crystal RAT infection or execution on a Windows system.
This rule detects the creation of specific mutexes that are known to be associated with Zenrat malware activity. The rule specifically looks for a mutex named 'System.Byte[]'. The presence of this mutex name is considered indicative of Zenrat malware.
This rule detects the creation of processes that utilize specific mutex names associated with YaRAT (Yet Another Remote Access Tool) malware. Specifically, it looks for the mutex name 'YandexDisk'. The presence of this mutex name is a strong indicator of YaRAT activity, as it is a known identifier for this particular RAT. This detection helps identify command and control (C2) communication or other malicious operations performed by YaRAT on a compromised system.
The rule detects the creation of specific mutexes known to be associated with Quasar RAT activity. It looks for mutex names matching 'QSR_MUTEX_<uniqueid>'.
This rule detects the creation of specific mutexes known to be associated with the REMCOS Remote Access Trojan (RAT). The rule looks for several distinct mutex names, including 'MARE_IS_BEAUTIFUL_EX', 'Rmc-<uniqueid>', 'Remcos_Mutex_Inj', 'remcos_<uniqueid>', 'Remcos-<uniqueid>', and 'Mutex_RemWatchdog'. The presence of any of these mutexes indicates potential REMCOS RAT activity on a Windows system.
Page 24 of 41