Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,003 detections
Filters
Last updated
All Time
Detection languages
732
640
208
129
126
Contributors
374
315
226
187
119
Categories
565
420
368
284
263
Platforms
1,428
228
198
197
98
Products / Services
443
284
282
147
129
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
2,003
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects default CSExec pipe creation
Detects remote PowerShell sessions
Detects remote PowerShell sessions
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Detects RDP session hijacking by using MSTSC shadowing
Detects when an admin share is mounted using net.exe
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Detect use of PDQ Deploy remote admin tool
Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.
This could potentially indicates a remote PowerShell connection.
Detects default RemCom pipe creation
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Page 95 of 96