Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
397 detections
Filters
Last updated
All Time
Detection languages
185
153
14
14
10
Contributors
96
91
56
27
24
Categories
207
85
56
43
43
Platforms
378
12
10
9
7
Products / Services
149
64
30
29
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
5
2
1
IDS Classtypes
3
1
IDS Protocols
2
1
Detects command lines associated with installing AnyDesk silently to run on startup or setting an unattended access password. Affiliates of The Gentlemen ransomware and other threat actors use this as a persistent fallback remote access channel.
Identifies when the ScreenMeet.Support.exe RMM tool is downloaded on a host or initiates network connections. This rule detects file creation events for 'ScreenMeet.Support.exe' and network connections made by processes with 'ScreenMeet.Support.exe' as the initiating process filename.
Detects the disabling of the Windows Firewall across all profiles using command-line tools such as netsh or PowerShell. This technique is commonly used by threat actors and ransomware affiliates, like The Gentlemen RaaS, to evade defenses and facilitate unrestricted lateral movement.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
This rule detects the execution of processes associated with Pulseway RMM (Remote Monitoring and Management) software. It specifically looks for process image file names, original filenames, or parent base filenames containing 'PCMonitorManager.exe' or 'pcmonitorsrv.exe'. These executables are known components of the Pulseway RMM agent. Detection of these processes can indicate the presence of legitimate RMM software, or potentially unauthorized remote access if not sanctioned by the organization.
This rule detects various indicators associated with the 'Fake Clawdbot VS Code Extension' malware, which is known to install the ScreenConnect Remote Access Trojan (RAT). Detection logic includes suspicious domain names, specific file names downloaded from those domains or Dropbox, known malicious IP addresses, specific SHA256 hashes of malicious files, outbound network connections on port 8041 (excluding common private/reserved IP ranges), ScreenConnect service installations/starts, and suspicious file writes or process executions from temporary directories related to ScreenConnect or 'Code.exe'.
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
Detects the execution of legitimate Remote Monitoring and Management (RMM) tools, such as AnyDesk, ScreenConnect, OptiTuneAgent, and SplashtopStreamer, when initiated from non-standard directories (outside 'C:\Program Files') or by command-line shells (powershell.exe, cmd.exe, wscript.exe, cscript.exe). This behavior is often abused by threat actors, including groups like Chaos RaaS, for persistence and remote access.
The rule detects VNC (Virtual Network Computing) application usage on Windows systems, looking for specific indicators in conjunction.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
Detects execution of AnyDesk on Windows endpoints. Adversaries may use legitimate remote access tools to obtain interactive access and to maintain persistence after initial compromise.
The rule detects the installation of the Gorelo RMM service by monitoring Windows System events (Event ID 7045) or Security events (Event ID 4697), which record the creation of new services. It specifically looks for service names or binary paths containing the string "gorelo", flagging the moment the agent is first established on the system.
The rule detects the execution of processes which are unique identifiers for the NetMonitor agent.
Detects process creation for common RMM tools (AnyDesk, Bomgar/BeyondTrust, TeamViewer).
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
This rule detects outbound network connections to known command and control (C2) infrastructure. Specifically, it looks for connections to suspicious URLs (meeting.bulletmailer.net, clawdbot.getintwopc.site, darkgptprivate.com, getintwopc.site) or specific IP addresses (179.43.176.32, 178.16.54.253), or connections on a specific port (8041) which has been associated with ScreenConnect C2. The rule also attempts to identify the specific threat indicator based on the matched URL, IP, or port.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects process, network, and file events associated with the fake 'ClawdBot Agent' VS Code extension. This malware drops weaponized ScreenConnect (Code.exe) and a Rust-based DWrite.dll loader. The rule covers Lightshot staging paths, relay C2 (bulletmailer.net:8041), extension C2 domains (getintwopc.site, clawdbot.getintwopc, darkgptprivate.com), and known payload hashes.
This rule detects when popular Remote Monitoring and Management (RMM) tools initiate network connections to public IP addresses. This behavior can be indicative of legitimate administrative tasks, but also of malicious activity where adversaries use these tools for remote access and control within a compromised environment. The rule specifically filters out connections to private IP ranges to reduce false positives related to internal network communication.
Detects indicators of compromise related to trojanized ScreenConnect installers and abuse of ScreenConnect C2 configuration. This rule identifies suspicious process executions of ScreenConnect components, known malicious hashes associated with ScreenConnect malware, ScreenConnect processes launched by installer executables (msiexec), network connections to ScreenConnect relay domains, DNS resolutions for ScreenConnect relays, modifications to 'system.config' files within ScreenConnect directories indicative of C2 configuration, and malicious registry artifacts related to ScreenConnect installation.
Page 6 of 19