Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
29
5
Contributors
34
Categories
14
6
4
4
3
Platforms
23
12
Products / Services
10,844
9,798
6,760
4,421
3,776
MITRE Techniques
19
12
11
9
7
CVEs
5
4
1
1
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Detects a PowerShell-driven sequence where a file is downloaded, has its Mark-of-the-Web removed via Unlock-File, then is executed through msiexec /i on the same file path within a 10-minute window, mirroring the SMOKE#SCREEN ScreenConnect delivery chain.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects execution/creation of the fake Zoom update installer (ZoomUpdateInstaller.pkg) on macOS endpoints correlated with a network connection to the SMOKE#SCREEN campaign relay IP 207.174.0.143 on port 8080.
Detects execution of a hidden-window .NET loader process launched from Temp/Downloads/AppData Local Temp directories, matching known SMOKE#SCREEN loader binary names or randomly generated 8-character executable names, excluding legitimate Program Files/System32 paths.
Detects execution of processes using filenames associated with the SMOKE#SCREEN campaign's masquerading payloads that either run from non-standard paths or lack a valid code-signing signature, indicating potential dropper or loader activity.
Detects lure-named payloads executing from Temp/AppData/Downloads paths that perform a self-elevation check followed by a RunAs relaunch, consistent with the SMOKE#SCREEN campaign's VBScript/batch installer behavior.
Detects lure-named payloads executing from Temp/AppData/Downloads paths that perform a self-elevation check followed by a RunAs relaunch, consistent with the SMOKE#SCREEN campaign's VBScript/batch installer behavior.
Detects silent/quiet msiexec.exe installations of ScreenConnect RMM client using suspicious or renamed MSI filenames staged in Temp, AppData\Local\Temp, or Downloads directories, spawned from scripting interpreters, consistent with the SMOKE#SCREEN campaign's abuse of ScreenConnect for persistent access.
Page 2 of 2