Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
32
12
2
1
1
Contributors
20
7
7
4
3
Categories
36
35
28
6
5
Platforms
33
17
2
1
Products / Services
26
11
8
8
7
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects the creation of new Group Policy Objects (GPOs), linking of GPOs at the domain root level, or modifications to existing GPOs that include 'Firewall' in their configuration settings. These activities are common precursors or indicators of persistence mechanisms and defensive bypass attempts by adversaries seeking to weaken security controls or maintain unauthorized access.
Detects the creation or modification of Network Address Translation (NAT) rules, port forwarding settings, or virtual IP configurations across various enterprise firewall vendors. This could indicate an adversary attempting to establish persistent inbound access to an internal network segment, bypass network egress controls, or perform reconnaissance on accessible services.
Detects the manual enablement of network discovery services (fdrespub, fdPHost, SSDPSRV, upnphost) and the associated Windows Firewall rules. This activity is a known tactic used by Gentlemen ransomware to facilitate lateral movement and network share enumeration by making the compromised host visible to others and allowing it to discover peers.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., ScreenConnect, AnyDesk, Atera) that are initiated from potentially untrusted parent processes like browsers, mail clients, or archive utilities, or that exhibit a code signing discrepancy. The rule further correlates these installation events with subsequent modifications to the Windows firewall within a two-hour window, which is indicative of an adversary establishing remote access persistence.
Detects unauthorized attempts to disable or modify Windows Firewall settings across multiple devices. The rule identifies suspicious registry modifications, firewall service termination events, or security policy changes that suggest an adversary is attempting to impair defensive mechanisms.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects the addition or modification of Windows Firewall rules by applications residing in non-standard or suspicious directories. It monitors Security Events 2004, 2071, and 2097, filtering out known legitimate system paths, common temporary directories, and updates from trusted Microsoft processes such as Windows Defender, svchost.exe, and dllhost.exe. By excluding standard operating system folders and common software installation paths, the rule highlights potentially malicious attempts to establish persistence or facilitate unauthorized network communication by bypassing standard firewall management channels.
This rule detects the addition or modification of Windows Firewall rules by applications residing in non-standard or suspicious directories. It monitors Security Events 2004, 2071, and 2097, filtering out known legitimate system paths, common temporary directories, and updates from trusted Microsoft processes such as Windows Defender, svchost.exe, and dllhost.exe. By excluding standard operating system folders and common software installation paths, the rule highlights potentially malicious attempts to establish persistence or facilitate unauthorized network communication by bypassing standard firewall management channels.
Detects the presence and execution of components related to the 'GhostCode' activity, specifically the installation of a rogue self-signed root certificate authority (CA) masquerading as Google Trust Services and the subsequent configuration of a local TLS-intercepting proxy. The detection monitors for the creation of specific archive files, modification of the system certificate store, addition of local firewall rules, and modification of the local hosts file.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects instances where Windows Filtering Platform (WFP) has blocked outbound network connections initiated by critical Microsoft Defender components (e.g., MsSense.exe, MsMpEng.exe). Such blocks may indicate security software interference, misconfiguration, or attempts to disrupt endpoint security monitoring.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects the disabling of host-based firewalls (Windows Filtering Platform/Advanced Firewall, iptables, or nftables) via command-line tools. The rule excludes common management tools, system accounts, and events where the firewall is re-enabled within a short timeframe, effectively filtering for potentially unauthorized attempts to impair security defenses.
Page 1 of 3