Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
This rule detects the execution of NetSupport Client Configurator (PCICFGUI.EXE) based on its description, product name, company, and original filename. NetSupport is a legitimate remote access tool that can be abused by adversaries to establish command and control, as highlighted by the MITRE ATT&CK framework.
This rule detects the execution of ScreenConnect, a legitimate remote access tool. Adversaries often abuse such tools to establish persistent command and control (C2) channels, move laterally within a network, and maintain access to compromised systems. The detection is based on specific product and company metadata associated with the ScreenConnect executable.
This rule detects the execution of 'mstsc.exe' (Microsoft Terminal Services Client) when it attempts to open a local RDP file located in suspicious directories. Adversaries may place RDP files in these locations to establish remote desktop connections, potentially for persistence, lateral movement, or command and control. The rule specifically looks for 'mstsc.exe' being executed with a command line argument ending in '.rdp' or '.rdp"' and containing paths commonly associated with temporary files, public user folders, or system directories that are not typical for legitimate RDP file storage.
This rule detects attempts to hijack the Amazon SSM Agent by monitoring process creation events for the 'amazon-ssm-agent.exe' executable when it is launched with specific command-line arguments: '-register', '-code', '-id', and '-region'. This combination of arguments is indicative of an attacker attempting to register a compromised SSM Agent with a new AWS account or region, effectively turning it into a remote access trojan (RAT) as described in the referenced Mitiga research.
This rule detects the execution of the GoToAssist remote access tool by looking for specific product and company metadata associated with the process. Adversaries often use legitimate remote access software like GoToAssist to establish command and control over compromised systems, blending in with normal IT support activities.
This rule detects the execution of the UltraViewer remote access tool. UltraViewer is a legitimate desktop support software that can be abused by adversaries to establish an interactive command and control channel to target systems. Detection is based on specific product, company, or original filename attributes associated with UltraViewer.
This rule detects the execution of AnyDesk, a legitimate remote access tool. Adversaries often abuse such tools to establish command and control (C2) channels to target systems, as they are commonly allowed by application control and can blend in with normal network traffic. The detection logic looks for specific image names, descriptions, product names, or company names associated with AnyDesk during process creation events.
Detects the piping of a password to an AnyDesk instance via the command line using the '--set-password' flag. This technique can be used by adversaries to programmatically set a password for AnyDesk, potentially for remote access.
This rule detects the execution of LogMeIn Guardian Service (LMIGuardianSvc) based on its description, product name, or company name. LogMeIn is a legitimate remote access tool that can be abused by adversaries to establish command and control over compromised systems. The rule specifically looks for process creation events where the 'Description' or 'Product' field contains 'LMIGuardianSvc' or the 'Company' field is 'LogMeIn, Inc.'.
Show usb mounted devices and drive letters
This rule detects the execution of AnyDesk, a legitimate remote access tool, from suspicious folders. Adversaries often use such tools to establish command and control channels. The rule specifically looks for AnyDesk executables (AnyDesk.exe or AnyDeskMSI.exe) that are not located in standard installation paths like 'Program Files' or 'AppData'.
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Count of sender's email addresses by subject
Detects the suspicious execution of `certreq.exe` with specific command-line arguments that indicate an attempt to download files. This technique is documented in LOLBAS (Living Off The Land Binaries and Scripts) as a method for adversaries to transfer files into a compromised environment, bypassing traditional security controls.
This rule detects the execution of the Notepad++ updater utility (GUP.exe) when it is launched by a process other than Notepad++ itself, and is used to download files from the internet. Specifically, it looks for GUP.exe being executed with command-line arguments indicating an unzip operation ('-unzipto') and a URL ('http'), while ensuring the parent process is not Notepad++. This behavior can indicate an adversary abusing a legitimate utility for ingress tool transfer.
This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.
This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.
Detects the use of the Windows Defender command-line utility, MpCmdRun.exe, to download files. This utility is typically used for managing Windows Defender, but adversaries can abuse its 'DownloadFile' function to retrieve arbitrary files from a specified URL, often for staging malicious payloads or tools.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
This rule detects the execution of the `finger.exe` utility on Windows systems. `finger.exe` is an old utility used to display information about users on a specified remote computer running the finger service. Given its age and the rarity of the finger service on modern systems, any execution of this utility is considered suspicious and warrants investigation.
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
Page 271 of 296