Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
397 detections
Filters
Last updated
All Time
Detection languages
185
153
14
14
10
Contributors
96
91
56
27
24
Categories
207
85
56
43
43
Platforms
378
12
10
9
7
Products / Services
149
64
30
29
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
5
2
1
IDS Classtypes
3
1
IDS Protocols
2
1
This rule detects the creation or modification of specific files associated with known malicious activity or remote access tools, specifically looking for shortcut files (LNK) named 'ApplianceConfig', 'ServerConfig', 'CredentialsConfig', or AnyDesk configuration files ('anydesk_svc.conf', 'anydesk_usr.conf'). These file patterns are often used by threat actors for persistence or to facilitate remote control.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
This rule detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement. The rule categorizes the detected tools into 'Tunneling' or 'RMM'.
Detects instances where the AnyDesk remote support application spawns suspicious child processes or administrative utilities. This rule specifically alerts on AnyDesk launching interpreters such as PowerShell, CMD, WScript, or utility binaries like dllhost, regsvr32, mshta, and rundll32, or when processes are executed in the context of the SYSTEM account (UserSid S-1-5-18). Such behavior is a common indicator of unauthorized remote access or post-exploitation activity.
Detects AnyDesk remote desktop used as persistent unauthorized C2 channel
Detects a browser-downloaded installer spawning ScreenConnect or another remote management client without an established software deployment parent. This rule identifies suspicious process creation where a known installer executable, likely downloaded from a browser (indicated by paths like Downloads, Temp, or AppData), initiates a remote monitoring and management (RMM) tool such as ScreenConnect or ConnectWiseControl. This behavior can indicate an adversary establishing remote access.
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
Detects a sequence of events where ManageEngine or IDrive remote monitoring software is followed within 120 minutes by the execution of potential staging or encryption-related tools (servertool.exe or encrypt.exe) on the same device. This pattern may indicate the abuse of legitimate administrative tools for unauthorized activities or ransomware-like behavior.
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
Detects a utility-themed parent process launching msiexec with a ScreenConnect or remote support installer and quiet options. This behavior is often associated with adversaries attempting to establish remote access covertly.
Detects when a ScreenConnect installer or related process loads the 'vcredist_x64.dll' file from a temporary, downloads, or AppData folder. This behavior can indicate DLL side-loading, where a malicious DLL is placed in a location that a legitimate application will search before its intended, trusted location, potentially for privilege escalation or persistence.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
Detects the installation or execution of ScreenConnect originating from the Azure Run Command extension context. This indicates potential unauthorized remote access tool deployment.
Detects silent MSI installations that drop specific DLLs (autorun.dll or vcredist_x64.dll) and subsequently spawn a ScreenConnect client service within a 5-minute window. This behavior is indicative of potential persistence or remote access tool deployment.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects network traffic to known Storm-2949 ScreenConnect infrastructure IPs. This rule identifies outbound network connections from devices to specific IP addresses associated with command and control (C2) infrastructure used by the Storm-2949 threat group, leveraging ScreenConnect for remote access.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Detects the malicious ScreenConnect module beaconing to attacker-controlled C2 infrastructure on custom ports 5443/8041. This rule specifically looks for network connections initiated by a process identified as 'ScreenConnect' to these non-standard ports, indicating potential command and control activity.
Page 4 of 19