Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects network connections to domains known to host and distribute malicious file converter applications that install Remote Access Trojans (RATs).
Detects the execution of known Remote Monitoring and Management (RMM) tools or related lures from suspicious user-writable directories like Downloads or Temp folders. Adversaries trick users into downloading RMM tools into these locations to bypass typical software installation monitoring.
This rule detects the execution of 'TOOLSIQ.EXE' (Zoho ManageEngine RMM) or 'Velociraptor.exe' when their parent process is either 'java.exe' or 'wrapper.exe'. This specific parent-child process relationship is indicative of post-exploitation activity, particularly in the context of a compromised SolarWinds Web Help Desk host, as described in the rule's context. The rule aims to identify the deployment of remote monitoring and management tools or C2 frameworks following an initial compromise.
Detects when a Remote Monitoring and Management (RMM) tool or a known lure spawns 'msiexec.exe' to download and execute a remote installer. This behavior is often abused by threat actors to deploy secondary payloads like additional C2 tools, leveraging legitimate RMM functionality.
Detects when a known Remote Monitoring and Management (RMM) tool is used to install a secondary RMM tool. Threat actors use this technique to establish redundant and persistent access to victim networks.
This rule detects the installation or execution of ScreenConnect client software. It looks for specific keywords in the process command line, folder paths, or file names associated with ScreenConnect. The rule also attempts to categorize the risk level based on the installation path, flagging installations in temporary directories or downloads as 'High Risk'.
Detects the creation or modification of the SimpleHelp RMM configuration file (serviceconfig.xml). Threat actors have been observed using SimpleHelp as part of a chained RMM attack, and this file contains the C2 server configuration.
This rule correlates the deployment of ScreenConnect components (identified by specific process names and image paths) with subsequent network communication to a known ScreenConnect C2 server (meeting.bulletmailer.net on port 8041). It aims to detect suspicious ScreenConnect activity, potentially indicating unauthorized remote access or control.
This query looks for any emails containing N8N webhooks linked to malicious Screen Connect installers
Lolbin is used to fetch the Atera's Remote Montoring and Management (RMM) agent directly from Atera's distribution domain.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects cmd.exe executing VS Code server components with named pipe usage, indicating VS Code remote server or tunnel activity that may be used for legitimate development or malicious C2 channels
Detects VS Code CLI (code.exe) executed with the --without-connection-token parameter, which disables authentication for remote tunnel access.
Detects instances where a ScreenConnect client or installer process is spawned by a web browser or email client. This behavior is indicative of a social engineering attack where a user is tricked into downloading and executing a rogue Remote Monitoring and Management (RMM) tool.
Detects modifications to Windows Registry keys related to Remote Desktop Protocol (RDP) configuration. Malware like DarkGate is known to manipulate these settings to enable or modify RDP for persistence and remote access.
Detect the execution of popular remote access and RDP applications. This can be used as a means to block their usage post incident.
I recommend a Cool-Off time period of at least 8hours to aggregate the threat events.
I recommend a Cool-Off time period of at least 8hours to aggregate the threat events.
Detects the presence of old versions of NetSupport Manager (client32.exe), a tool repurposed as a RAT by the Bloody Wolf threat actor. The actor is known to use versions from October 2013 or older. This rule specifically looks for 'client32.exe' with the file description 'NetSupport Client' and a FileVersion older than '12.0.0.0'.
RMM Tool Hunting
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
This rule identifies and summarizes the usage of various Remote Monitoring and Management (RMM) tools across an environment. It correlates process execution events (based on executable and process names) and network connection events (based on remote URLs/domains) with a predefined list of known RMM tools. The output provides a count of unique devices using each RMM tool, grouped by machine group, allowing for an overview of RMM tool prevalence and distribution.
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo-rmm .azurewebsites .net)
Page 27 of 41