Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
135 detections
Filters
Last updated
All Time
Detection languages
52
33
21
8
7
Contributors
43
26
21
19
5
Categories
38
35
33
29
22
Platforms
119
25
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
54
50
37
36
19
CVEs
10
3
3
1
IDS Classtypes
20
1
IDS Protocols
21
Correlates the RMM shell modifying the fDenyTSConnections registry key to force-enable Remote Desktop Protocol for interactive lateral movement.
This rule detects a high frequency of incoming TCP synchronization (SYN) packets on port 3389 (RDP) from a single external source within a short timeframe. This behavior is indicative of a brute-force or credential-stuffing attack against Remote Desktop services.
Detects a high frequency of incoming TCP SYN packets targeting port 3389 (RDP) from a single source within a short time window. This behavior is indicative of a brute-force or credential-stuffing attack against Remote Desktop services.
Detects repeated inbound TCP connection attempts to port 3389 (RDP) from a single source address within a short timeframe. This behavior is indicative of an RDP brute-force or password spraying attack targeting remote desktop services.
This rule detects rapid, successive TCP connection attempts directed to port 3389 (RDP) from a single external source IP within a short timeframe. This behavior is indicative of a brute force attack or automated credential guessing activity targeting remote desktop services.
Detects the modification of the 'fDenyTSConnections' registry key using 'reg.exe' to force-enable Remote Desktop Protocol (RDP) on a system, followed by an immediate connection attempt to port 3389. This behavior is indicative of an adversary or RMM-based tool attempting to establish unauthorized remote access for lateral movement.
Detects a suspicious sequence of events where a user initiates an outbound RDP connection using mstsc.exe on port 3389, followed shortly by the execution of a file named MicrosoftUpdateOneDrive.exe. This behavior is indicative of the Turla threat group deploying their STOCKSTAY.MARKETMAKER malware via an RDP-based phishing lure.
Detects RDP connections originating from external internet addresses
This rule detects multiple Network Level Authentication (NLA) negotiation attempts targeting port 3389 from a single source within a 60-second window, which is indicative of an RDP brute-force attack.
Identifies the use of tscon.exe without authorization to hijack or "shadow" active RDP sessions, a key lateral movement and spying technique. The rule specifically looks for tscon.exe being executed with command-line arguments '/dest:console' or '/dest:rdp-tcp', which are indicative of attempting to connect to or shadow an existing RDP session.
This rule detects potentially unauthorized or suspicious Remote Desktop Protocol (RDP) activity by monitoring for instances of 'mstsc.exe' initiated with specific command-line arguments, or identifying child processes spawned by RDP-related binaries ('mstsc.exe', 'rdpclip.exe') that are not typically associated with standard RDP functionality.
This rule detects a successful Remote Desktop Protocol (RDP) login that is immediately preceded by 20 or more failed RDP authentication attempts from the same source IP to the same destination IP within a 15-minute window. This pattern is indicative of a brute force attack that has successfully compromised credentials.
Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.
Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Detects modifications to critical registry settings that weaken security controls related to NTLM authentication, Restricted Admin mode, and RDP security. The rule specifically looks for disabling NTLM traffic restrictions (RestrictSendingNTLMTraffic set to 0), disabling Restricted Admin mode (DisableRestrictedAdmin set to 0), or weakening RDP security by setting the SecurityLayer to '1'. An alert is generated if two or more such modifications occur within a 7-day timeframe.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
Page 4 of 7