Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
397 detections
Filters
Last updated
All Time
Detection languages
185
153
14
14
10
Contributors
96
91
56
27
24
Categories
207
85
56
43
43
Platforms
378
12
10
9
7
Products / Services
149
64
30
29
18
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
7
5
2
1
IDS Classtypes
3
1
IDS Protocols
2
1
Detects the creation of log files during a TeamViewer remote session
Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects a tscon.exe start as LOCAL SYSTEM
This detection rule identifies the execution of uncommon or suspicious Remote Monitoring and Management (RMM) tools. While RMM tools are legitimate for IT administration, they are frequently abused by attackers, initial access brokers (IABs), and ransomware operators to establish persistent remote access, execute malicious commands, or deploy additional payloads. The rule specifically looks for process launches of various RMM software that might not be commonly observed in an environment, indicating potential unauthorized access or lateral movement. The list of RMM tools is informed by the LOL-RMM (Living Off the Land RMM) project.
Detects the installation of the AnyDesk remote access software service. This could indicate abuse if AnyDesk is not legitimately used within the environment. The rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, where the service name or image path contains 'AnyDesk' and the service name also contains 'Service'.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects file modifications to the temporary XML user database file in the ScreenConnect server. This activity can indicate local user modification, potentially as part of the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8. It may also be observed during legitimate modifications to local users or permissions within ScreenConnect.
This rule detects file modifications to the temporary XML user database file within the ScreenConnect server. Such modifications can indicate local user changes, which may occur during the exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions prior to 23.9.8. Legitimate modifications to local users or permissions within ScreenConnect can also trigger this detection. This rule requires Advanced Auditing to log successful Windows Event ID 4663 events and a System Access Control List (SACL) set on the relevant ScreenConnect directory.
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects command execution events originating from ScreenConnect, a legitimate remote administration tool. This rule specifically looks for Windows application log events where ScreenConnect is the provider and an event ID of 200 indicates a command of a certain length was executed. This activity can be indicative of an attacker using ScreenConnect for malicious purposes, such as executing arbitrary commands on a compromised system.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
Detects the creation of temporary files by the ScreenConnect remote monitoring and management (RMM) tool in a specific user document directory. This behavior is associated with ScreenConnect's feature to remotely execute binaries on a target machine, where these binaries are first dropped to the specified temporary location before execution.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Page 19 of 19