Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
397 detections
Filters
Last updated
All Time
Detection languages
185
153
14
14
10
Contributors
96
91
56
27
24
Categories
207
85
56
43
43
Platforms
378
12
10
9
7
Products / Services
149
64
30
29
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
5
2
1
IDS Classtypes
3
1
IDS Protocols
2
1
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
Detects a sequence of events where ManageEngine or IDrive remote monitoring software is followed within 120 minutes by the execution of potential staging or encryption-related tools (servertool.exe or encrypt.exe) on the same device. This pattern may indicate the abuse of legitimate administrative tools for unauthorized activities or ransomware-like behavior.
Detects the RMMProject RTSC module spawning web browsers (Chrome or Edge) in a hidden desktop environment. This behavior is indicative of an adversary attempting to perform actions on a system without the user's direct knowledge or visibility, often associated with remote access and control.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
Detects TeamViewer being used for unauthorized persistent remote access
This rule detects the execution of ScreenConnect, a remote access tool, directly spawned by ComputerDefaults.exe. This behavior is indicative of a UAC bypass technique, specifically observed in the 'Operation SilentCanvas' campaign.
Detects TeamViewer being used for unauthorized persistent remote access
Detects the execution of an executable from the temporary ScreenConnect application directory. This behavior has been observed in recent malvertising campaigns where rogue ScreenConnect instances are used to deploy and execute multi-stage crypters (e.g., FatMalloc/crypteds.exe) from this directory, initiating ransomware and BYOVD payloads.
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects VNC connections used for visual remote desktop lateral movement
Detects download of remote access tools following vishing contact
Detects abuse of trusted MSP remote management tools for initial access
Detects the execution of Chrome Remote Desktop (remoting_host.exe) with daemon flags, which NightSpire ransomware operators use to establish persistence.
This rule detects the use of TCP port 5938, which is commonly associated with the TeamViewer protocol. The rule is specifically looking for established connections to this port, indicating potential remote command and control (C2) activity. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent TeamViewer usage while still catching suspicious patterns.
This rule detects network traffic indicative of AnyDesk remote desktop software being used as a command and control (C2) channel. It specifically looks for HTTP requests to 'anydesk.com' or 'relay.anydesk.com' domains. A threshold of 5 connections within 60 seconds from the same source IP is set to reduce false positives.
This rule detects HTTP network connections to TeamViewer domains, specifically 'teamviewer.com' or 'router.teamviewer.com'. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This behavior is indicative of TeamViewer being used for persistent command and control (C2) activities, often associated with trojan activity.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
Process Creation of LOLRMM Tools
Gravwell
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
Page 5 of 19