Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
397 detections
Filters
Last updated
All Time
Detection languages
185
153
14
14
10
Contributors
96
91
56
27
24
Categories
207
85
56
43
43
Platforms
378
12
10
9
7
Products / Services
149
64
30
29
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
5
2
1
IDS Classtypes
3
1
IDS Protocols
2
1
Detects the presence of Chrome Remote Desktop processes or execution of Windows Installer (msiexec.exe) and GoogleUpdate.exe, which are often used by adversaries for remote access or as a proxy for malicious payload execution.
Detects execution of AnyDesk from non-standard directories such as Temp, AppData, or User profile folders, often indicative of unauthorized or portable installation of remote access software.
Detects suspicious file transfer and subsequent execution activity associated with the ScreenConnect (ConnectWise Control) remote access application, which may indicate exploitation of file-transfer vulnerabilities. The rule monitors for ScreenConnect processes dropping executable or script files to disk followed by the spawning of command interpreters to execute those files.
TeamViewer_Desktop.exe is create during install
Detects suspicious file transfer and subsequent execution activity associated with the ScreenConnect (ConnectWise Control) remote access application, which may indicate exploitation of file-transfer vulnerabilities. The rule monitors for ScreenConnect processes dropping executable or script files to disk followed by the spawning of command interpreters to execute those files.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the execution of anydesk.exe from user-writable directories such as AppData, Temp, Downloads, or Music. This behavior is indicative of potential unauthorized use of remote access software, which may be deployed by an adversary for persistence or establishing a command and control channel outside of standard administrative tools.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
This rule detects the silent installation of AnyDesk with persistence enabled via the '--start-with-win' flag. This behavior is indicative of unauthorized remote access tool deployment, often used for establishing persistent command and control.
Detects the creation or starting of an AnyDesk service using command-line arguments to specify custom configuration directories or service names. This pattern is often used by adversaries to establish persistence or ensure remote access tools are configured with specific, potentially silent or pre-defined, settings.
Detects a specific sequence of commands involving the termination of the AnyDesk process using taskkill, a short delay via the timeout command, and an immediate system reboot. This sequence is often associated with persistence setup or system preparation by threat actors.
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.
Detects suspicious use of QEMU virtualization software within an environment, specifically when associated with ConnectWise ScreenConnect. This includes the creation of custom QEMU image files within the ScreenConnect Files directory, the execution of the QEMU binary using those images, the extraction of QEMU archives using 7-Zip, or instances where ScreenConnect processes spawn the QEMU binary directly. This pattern is indicative of unauthorized use of virtual machines to facilitate persistence, lateral movement, or tool staging.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects multiple suspicious activities associated with the AnyDesk remote access application, including the creation of specific named pipes, execution of processes with sensitive command-line arguments (e.g., comsvcs, impersonation privileges), non-standard DLL loads by the application, and the spawning of system-level processes. These behaviors are indicative of abuse of remote access software for post-exploitation activities or privilege escalation.
Detects the execution of Visual Studio Code (code.exe or code-tunnel) with command-line arguments indicative of remote access, tunneling, or server functionality. This behavior can be legitimate for developers or IT administrators but may also be abused by adversaries for command and control or data exfiltration.
Detects download of remote access tools used in vishing attacks
This rule monitors for the creation of the 'adprinterpipe' named pipe by the AnyDesk remote support application. This behavior can be indicative of remote session activity or misuse of the AnyDesk software, often used as a vector for remote command and control.
Page 3 of 19