Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
Detects the execution of known Remote Monitoring and Management (RMM) tools from common staging directories (e.g., Temp, Downloads, AppData) or using command-line arguments indicative of a silent or hidden installation, which is a common pattern for initial access and persistence by adversaries.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. This activity can signify possible compromised hosts on the network.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects the execution of a ScreenConnect installer executable followed by the deployment or startup of its associated client components (WindowsClient.exe or ClientService.exe) within a 30-minute window on the same device. This rule is designed to identify the unauthorized installation or deployment of remote access software.
Detects the execution of a ScreenConnect installer executable followed by the deployment or startup of its associated client components (WindowsClient.exe or ClientService.exe) within a 30-minute window on the same device. This rule is designed to identify the unauthorized installation or deployment of remote access software.
This rule detects the execution of common remote access and management (RMM) tools from non-standard directories such as user profiles, temp folders, or other locations outside of standard application installation paths (e.g., Program Files or ProgramData). Such activity is often indicative of unauthorized remote access setup or the use of portable RMM binaries by an adversary to maintain persistent access.
This rule detects the execution of common remote access and management (RMM) tools from non-standard directories such as user profiles, temp folders, or other locations outside of standard application installation paths (e.g., Program Files or ProgramData). Such activity is often indicative of unauthorized remote access setup or the use of portable RMM binaries by an adversary to maintain persistent access.
This rule detects the execution of common remote access and management (RMM) tools from non-standard directories such as user profiles, temp folders, or other locations outside of standard application installation paths (e.g., Program Files or ProgramData). Such activity is often indicative of unauthorized remote access setup or the use of portable RMM binaries by an adversary to maintain persistent access.
Detects ScreenConnect client processes initiating outbound network connections to external cloud relay addresses (typically *-relay.screenconnect.com) from locations outside of standard Program Files directories. This behavior is indicative of unauthorized, standalone, or adversary-deployed ScreenConnect instances attempting to establish a Command and Control (C2) channel, bypassing standard IT-managed deployment pathways.
This rule detects potential unauthorized Remote Monitoring and Management (RMM) tool installation activities. It looks for common patterns used by adversaries to deploy RMM agents, including silent MSI installations from HTTPS URLs, batch/VBS scripts performing administrative privilege checks prior to silent execution, and PowerShell commands utilizing 'Start-Process' with elevated privileges to download and execute files from the internet.
This rule detects the execution of common Remote Monitoring and Management (RMM) and remote access tools when initiated from suspicious parent processes (such as browsers, office applications, or command-line interpreters), originating from common writeable directories (e.g., Temp, Downloads), or executed with command-line arguments indicative of silent/unattended installation. This behavior is often associated with initial access, persistence establishment, or unauthorized remote control of a system.
Detects the installation and execution of MeshAgent, a remote monitoring and management (RMM) tool, by identifying specific command-line arguments, service names, and renamed binary execution. Adversaries often use RMM tools for persistent remote access and command and control.
This rule detects potential post-compromise activity related to a campaign using MSP360-masqueraded installers and ScreenConnect remote access tools. It performs an IOC sweep across device file events for known malicious file hashes (associated with installers and post-compromise utilities) and device network events for connections to known malicious domains used for command and control.
This rule detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer) on Windows endpoints within a 4-hour window of associated cloud identity risk activity (such as risky sign-ins, MFA changes, or privilege grants). It filters out legitimate activity initiated via standard software management pipelines (e.g., SCCM, Intune) to identify potential unauthorized use of remote access software by adversaries following account compromise.
This rule detects the execution of common Remote Monitoring and Management (RMM) and remote access tools (e.g., ScreenConnect, AnyDesk, Atera, Splashtop, NinjaOne, Action1) when the command line includes silent install or installation flags. The detection correlates this activity with recent (within 72 hours) identity-related alerts (e.g., impossible travel, anomalous sign-in, credential compromise) for the same user, suggesting a potential high-risk scenario where an adversary is establishing remote access following a credential compromise.
This rule detects HTTP GET requests to known malicious domains or URI patterns associated with fake video-conferencing lures. These lures redirect users to download RMM (Remote Monitoring and Management) MSI installers, often masquerading as legitimate software like Adobe Reader or video conferencing tools, as part of a social engineering campaign for initial access.
Detects the execution of legitimate remote-access software commonly used in social engineering attacks, such as Quick Assist and AnyDesk. These tools are frequently abused as an initial access or persistence mechanism by threat actors following initial contact via methods like vishing or email-based social engineering.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
Page 3 of 41