Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Detects the installation of the Mesh Agent service, which is commonly used for remote computer management. This rule specifically looks for Windows Event ID 7045 from the Service Control Manager, indicating a service installation, and then checks if the service's image path contains 'MeshAgent.exe' or if the service name contains 'Mesh Agent'.
This rule detects the creation or modification of AnyDesk configuration files (user.conf and system.conf) in the AppData\Roaming\AnyDesk directory. Adversaries often use legitimate remote access tools like AnyDesk to establish command and control, and the presence of these configuration files can indicate its use on a system. This rule helps identify the presence of AnyDesk artifacts, which could be indicative of legitimate use or malicious activity.
Detects the execution of Action1, a Remote Monitoring and Management (RMM) tool, for arbitrary code execution or to establish remote sessions. The rule identifies these activities by looking for specific command-line patterns associated with Action1 agent deployments, script execution (via cmd.exe or powershell.exe), and the initiation of remote sessions through 'agent1_remote.exe'. The description also provides hunting opportunities to refine detection by baselining policy names and identifying remote sessions during abnormal hours.
Detects incoming network connections to the AnyDesk remote access application. This activity could indicate an adversary attempting to establish a remote command and control channel or gain unauthorized access to a system using a legitimate remote access tool.
This rule detects attempts to hijack the Amazon SSM Agent on Linux systems. Specifically, it looks for the 'amazon-ssm-agent' executable being run with command-line arguments indicative of registration with a new code, ID, and region. This behavior is consistent with the technique described in the Mitiga research report where the SSM agent can be abused as a remote access trojan for persistence and command and control.
This rule detects the creation of temporary installation artifacts for GoToAssist Remote Support Expert in the user's AppData\Local\Temp directory. Adversaries often use legitimate remote access tools like GoToAssist to establish command and control, and the presence of these temporary files can indicate such activity.
This rule detects the creation of 'TeamViewer_Desktop.exe' on a Windows system. This file is typically created during the installation of TeamViewer, a legitimate remote access tool. Adversaries often abuse such tools for command and control, making its installation a potential indicator of compromise.
This rule detects the creation or modification of files containing the string '\Bin\ScreenConnect.' in their target filename. This pattern is indicative of temporary installation artifacts for ScreenConnect, a legitimate remote access tool that can be abused by adversaries for command and control or remote access. The rule aims to identify the presence of these artifacts, which could signal the installation or use of ScreenConnect on a system.
This rule detects the creation of processes associated with UltraVNC Viewer, a legitimate remote access software. Adversaries often use such tools to establish command and control (C2) channels to target systems, enabling remote interaction and control. The rule specifically looks for process creation events where the description is 'VNCViewer', the product is 'UltraVNC VNCViewer', the company is 'UltraVNC', or the original filename is 'VNCViewer.exe'.
Detects the silent installation of AnyDesk Remote Desktop, which can be used by attackers to gain remote access to a system. The rule specifically looks for the command-line arguments '--install', '--start-with-win', and '--silent' used together during process creation.
This rule detects the execution of NetSupport Client Configurator (PCICFGUI.EXE) based on its description, product name, company, and original filename. NetSupport is a legitimate remote access tool that can be abused by adversaries to establish command and control, as highlighted by the MITRE ATT&CK framework.
This rule detects the execution of ScreenConnect, a legitimate remote access tool. Adversaries often abuse such tools to establish persistent command and control (C2) channels, move laterally within a network, and maintain access to compromised systems. The detection is based on specific product and company metadata associated with the ScreenConnect executable.
This rule detects the execution of the GoToAssist remote access tool by looking for specific product and company metadata associated with the process. Adversaries often use legitimate remote access software like GoToAssist to establish command and control over compromised systems, blending in with normal IT support activities.
This rule detects the execution of the UltraViewer remote access tool. UltraViewer is a legitimate desktop support software that can be abused by adversaries to establish an interactive command and control channel to target systems. Detection is based on specific product, company, or original filename attributes associated with UltraViewer.
This rule detects the execution of AnyDesk, a legitimate remote access tool. Adversaries often abuse such tools to establish command and control (C2) channels to target systems, as they are commonly allowed by application control and can blend in with normal network traffic. The detection logic looks for specific image names, descriptions, product names, or company names associated with AnyDesk during process creation events.
This rule detects the execution of LogMeIn Guardian Service (LMIGuardianSvc) based on its description, product name, or company name. LogMeIn is a legitimate remote access tool that can be abused by adversaries to establish command and control over compromised systems. The rule specifically looks for process creation events where the 'Description' or 'Product' field contains 'LMIGuardianSvc' or the 'Company' field is 'LogMeIn, Inc.'.
Page 39 of 41