Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
ET INFO Observed RMM Domain in DNS Lookup (meshcentral .com)
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo .tech)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo-rmm .azurewebsites .net)
ET INFO Observed RMM Domain (meshcentral .com in TLS SNI)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo .tech)
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. Specifically, it looks for Velociraptor spawning 'code.exe' with tunneling arguments, 'msiexec' with '/i' and 'http' for remote installation, or PowerShell/pwsh executing web requests or file downloads.
This rule detects the installation or start of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools to maintain persistence, escalate privileges, or establish command and control over compromised systems. The rule specifically looks for Event IDs 7045 (Service Installation) and 7036 (Service Started) from the 'Service Control Manager' provider, where the service name contains keywords indicative of known remote access software such as AmmyyAdmin, TeamViewer, LogMeIn, and others.
Detects network connections initiated by Microsoft Quick Assist (QuickAssist.exe) to its official relay server. This activity is expected for legitimate Quick Assist usage, but monitoring it can help identify unauthorized remote access or potential abuse of the tool.
This rule detects the execution of Visual Studio Code's tunnel feature. Attackers can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control a compromised system. The rule looks for specific command-line arguments associated with the tunnel feature, including '.exe tunnel' and '--accept-server-license-terms'. It also identifies scenarios where 'cmd.exe' is used as a parent process to launch the tunnel, specifically looking for 'code-server.cmd' within the command line.
This rule detects the execution of Visual Studio Code (VS Code) tunnel functionality, particularly when the executable has been renamed. Attackers can abuse this feature to establish a command and control (C2) channel, bypassing typical network restrictions. The rule looks for command-line arguments indicative of VS Code tunnel activation, including specific arguments for accepting license terms or running as a service, and also checks for `cmd.exe` spawning the tunnel process.
This analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. The rule compares observed process names with a list of known remote access software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
The analytic detects the writing of files from known remote access software to disk within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on file path, file name, and user information. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration, further compromise, or complete control over affected systems.
Detects the installation and configuration of a TacticalRMM agent where specific command-line flags (--api, --auth, --client-id, --site-id, --agent-type) are used. This indicates the agent is being configured to connect to a particular RMM server with authentication and client/site identification. This activity could signify a threat actor attempting to register the agent with their own controlled RMM infrastructure for persistent remote access.
This rule detects the connection of specific USB devices that are commonly associated with IP KVM (Keyboard, Video, Mouse) devices. It identifies these devices by checking the 'Manufacturer' field for 'PiKVM' or 'tinypilot', the 'vendorid' for a specific hexadecimal string ('6b65796d696d6670690'), or the 'SerialNumber' for 'CAFEBABE'. The rule monitors various USB device connection events such as 'USBDeviceConnected', 'UsbDriveMounted', 'UsbDriveUnmounted', 'UsbDeviceDisconnected', 'DeviceDisplayConnected', and 'PnpDeviceConnected' within 'DeviceEvents'. The presence of such devices can indicate remote access or potential compromise, as IP KVMs allow network-based control of a computer.
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Detects the execution of a Remote Desktop Protocol (.rdp) file from a temporary directory associated with Microsoft Outlook. This behavior is a key indicator of the initial access phase of the "Rogue RDP" campaign, where attackers deliver malicious .rdp files via email to compromise systems.
This rule detects suspicious activities related to Remote Monitoring and Management (RMM) tools by querying various data sources. It identifies processes, file signatures, network connections, and firewall logs associated with known RMM tools and domains, helping to uncover potential security threats. The rule leverages an external IOC list for RMM tool names, file signatures, and associated domains.
This rule detects the creation of processes associated with various legitimate remote access and remote monitoring/management (RMM) tools. It specifically looks for common executable names and patterns for tools like AnyDesk, TeamViewer, ngrok, Splashtop, ScreenConnect, ConnectWise Control, Pulseway, TacticalRMM, Tailscale, and Level. The rule includes exclusions for specified administrative users and legitimate parent processes to reduce false positives. The primary goal is to identify potentially unauthorized or suspicious usage of these tools, which can be leveraged by adversaries for remote access, command and control, or data exfiltration.
Page 28 of 41