Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
12
8
3
2
1
Contributors
11
5
5
2
1
Categories
8
8
8
8
5
Platforms
11
9
9
4
2
Products / Services
14
8
8
3
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
6
2
IDS Protocols
7
1
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
This rule detects the download of common Remote Access Tools (RATs) such as AnyDesk, TeamViewer, UltraViewer, RustDesk, and Zoho Assist. It specifically looks for these keywords in the HTTP URI during client-to-server HTTP traffic. The rule is categorized as 'trojan-activity' and is intended to alert when a user might be downloading these tools, potentially after social engineering or phone contact, as suggested by the rule's message.
This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.
This rule detects web pages served to clients that contain characteristics commonly associated with tech support scams. Specifically, it looks for HTTP responses containing the words "call", "1-800", and "virus" (case-insensitive) in the file data. This combination of keywords suggests an attempt to trick users into calling a fake support number due to a fabricated "virus" infection.
KQL Query from file: Threat hunting voice phishing for Teams
Page 2 of 2