Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects the creation of specific mutex names associated with the DarkTrack Remote Access Trojan (RAT). The mutex name 'I_AM_DT<uniqueid>' is a known indicator of DarkTrack activity. Detection of this mutex suggests that a DarkTrack RAT may be active on the system, potentially indicating a compromise related to command and control (C2) operations.
This rule detects the creation of specific mutexes known to be associated with Cybergate RAT activity. The detection is based on a predefined list of mutex names, including '***MUTEX***_SAIR', 'SPY_NET_RATMUTEX', '_x_X_PASSWORDLIST_X_x_', '_x_X_BLOCKMOUSE_X_x_', 'xX_PROXY_SERVER_Xx', and '_x_X_UPDATE_X_x_'. The presence of any of these mutexes indicates potential Cybergate RAT infection or activity on a Windows system.
Detects known mutexes associated with Celestial RAT activity. The rule specifically looks for mutex names matching 'celestial_<uniqueid>'.
This rule detects the creation of processes that utilize specific mutex names associated with the Borat Remote Access Trojan (RAT). The detection is triggered when a process creates a mutex named 'boratratmutex_sa8xofh1budx'. This mutex name is a known indicator of compromise for the Borat RAT, suggesting active malware presence or execution on the system. The rule leverages process creation logs to identify these mutexes.
The rule detects the creation of specific mutexes ('rendumm' or 'RfmbFv8D') that are known to be associated with the BADNEWS Remote Access Trojan (RAT). This activity indicates the presence and potential execution of the BADNEWS malware on a Windows system.
The rule detects the creation of specific mutexes known to be associated with ArrowRAT malware. It specifically looks for the mutex name 'ArrowRAT_Mutex_ArrowRAT'. This activity indicates the presence and execution of ArrowRAT on a Windows system.
The rule detects the creation of specific mutex names ('rmldKj40qW2UTlEe') which are known to be associated with MasonRAT activity. This indicates the presence and execution of the MasonRAT malware on a system.
This rule detects the MIMICRAT custom RAT by identifying specific byte patterns within files or memory. These patterns were published by Elastic Security Labs and are indicative of the malware's presence.
Detects process creation for common RMM tools (AnyDesk, Bomgar/BeyondTrust, TeamViewer).
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
Detects Anydesk execution from Users\Public directory, which may indicate suspicious remote access usage.
This rule detects the execution of processes associated with a JWrapper-packaged SimpleHelp Remote Access Trojan (RAT). The execution from the specific 'ProgramData\JWrapper-Remote Access' directory is a strong indicator of the malicious activity described in the Cofense report. The rule specifically looks for 'Remote AccessWinLauncher.exe', 'windowslauncher.exe', and 'winpty-agent64.exe' being executed from 'C:\ProgramData\JWrapper-Remote Access'.
Detects the creation or execution of files, often in C:\ProgramData, with a file description of 'SimpleHelp Remote Access Client' but using non-standard or renamed filenames. This is indicative of threat actors deploying the SimpleHelp RMM tool for persistence, as observed in campaigns exploiting CVE-2026-1731 in BeyondTrust.
Detects the execution of a SimpleHelp RMM executable from a non-standard file path. This behavior is associated with threat actors establishing persistence after exploiting vulnerabilities like CVE-2026-1731 in BeyondTrust appliances.
Detects network connections or DNS queries to domains and IP addresses identified as payload delivery and C2 infrastructure for a JWrapper/SimpleHelp RAT campaign. Monitoring these indicators can help detect initial compromise or ongoing C2 communication.
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.
This rule detects the use of unauthorized Remote Monitoring and Management (RMM) tools by identifying network connections to RMM-related URLs that have not been observed in a baseline period (last 7 days) but are observed in the last hour. It specifically filters out connections to approved RMM domains and known initiating processes (like web browsers) to reduce false positives. The rule leverages an external list of RMM domains to identify suspicious activity.
This rule detects network connections to known Remote Monitoring and Management (RMM) tool domains initiated by `cmd.exe` or `powershell.exe`. This behavior can indicate the unauthorized use of RMM tools by an adversary to gain remote access and control over a compromised system. The rule specifically looks for successful network connections where the remote URL matches a URI from a curated list of RMM domains, and the initiating process is either `cmd.exe` or `powershell.exe`, excluding a specific bypass command line.
Detects known malicious file hashes associated with the Clawdbot VS Code extension malware. This includes the weaponized ScreenConnect installer (Code.exe) and the Rust-based loader (DWrite.dll).
This rule detects file and network indicators of compromise (IOCs) associated with the fake 'ClawdBot Agent' VS Code extension malware campaign. It looks for known malicious file hashes and network connections to C2 infrastructure, including specific C2 checks for ScreenConnect relay on port 8041.
This rule detects when popular Remote Monitoring and Management (RMM) tools initiate network connections to public IP addresses. This behavior can be indicative of legitimate administrative tasks, but also of malicious activity where adversaries use these tools for remote access and control within a compromised environment. The rule specifically filters out connections to private IP ranges to reduce false positives related to internal network communication.
Page 26 of 41