Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
Detects anomalous, chained execution patterns initiated by AI agents integrated with Model Context Protocol (MCP) servers. The rule identifies a multi-stage sequence involving the invocation of browser automation tools followed by shell execution and subsequent outbound network activity, potentially indicating an AI-driven attack chaining filesystem, shell, or cloud-API access in an unauthorized manner.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.
Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
This rule detects a suspicious sequence of events where a process named RMM.Agent.exe executes a PowerShell command to download and install 'ClientSetup.msi' via msiexec.exe, followed closely by the execution of a ScreenConnect client process. This chain of activity is consistent with unauthorized or potentially malicious deployment of ScreenConnect (ConnectWise Control) for persistent remote access.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Detects unauthorized modification or creation of registry keys under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\ to maintain persistence for remote access/RMM tools during Safe Mode with Networking. This technique is used by Akira ransomware affiliates to evade EDR and security software.
Detects outbound network traffic from internal servers to known Remote Monitoring and Management (RMM) platforms (AnyDesk, ScreenConnect, Atera). This activity is often used by adversaries to establish covert command and control (C2) channels and remote access to internal resources.
This rule detects the execution of common remote access tools (Quick Assist, AnyDesk) on a host that does not have a prior history of using those specific tools. This is intended to identify potential hands-on-keyboard activity by adversaries following initial access via social engineering, such as vishing or email-bombing, where they attempt to establish a persistent remote access foothold.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects network activity associated with the RatHat Android malware, specifically focusing on its use of WebSocket-based FRP (Fast Reverse Proxy) tunnels for command and control, session initialization, configuration retrieval, and local loopback proxy communication.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.
Detects network activity associated with NetSupport Manager remote access software, specifically monitoring for connections to known malicious domains and infrastructure, as well as recurring beaconing patterns indicative of command-and-control behavior.
Detects network communication to a known malicious IP address (45.32.253.166) associated with the PIVOTPIPE RAT using Cobalt Strike C2 beaconing patterns. The rule identifies TCP connections, HTTP GET requests for beacon check-ins, and HTTP POST requests for task responses.
Flags installation of RMM tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) on an endpoint shortly after that user's account undergoes a password/MFA reset — matches the post-vishing tooling pattern CrowdStrike attributes to Mutant Spider (loaders including PrionFlaire and SocksLoader) and Scattered Spider.
Page 7 of 41