Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,439
11,829
5,873
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
This rule detects the creation or modification of AnyDesk configuration files (user.conf and system.conf) in the AppData\Roaming\AnyDesk directory. Adversaries often use legitimate remote access tools like AnyDesk to establish command and control, and the presence of these configuration files can indicate its use on a system. This rule helps identify the presence of AnyDesk artifacts, which could be indicative of legitimate use or malicious activity.
Detects the creation of specific log files associated with TeamViewer remote sessions. This can indicate the use of TeamViewer for remote access, which might be legitimate or malicious depending on the context.
This rule detects the creation of temporary installation artifacts for GoToAssist Remote Support Expert in the user's AppData\Local\Temp directory. Adversaries often use legitimate remote access tools like GoToAssist to establish command and control, and the presence of these temporary files can indicate such activity.
This rule detects the creation or modification of files containing the string '\Bin\ScreenConnect.' in their target filename. This pattern is indicative of temporary installation artifacts for ScreenConnect, a legitimate remote access tool that can be abused by adversaries for command and control or remote access. The rule aims to identify the presence of these artifacts, which could signal the installation or use of ScreenConnect on a system.
Show usb mounted devices and drive letters
This YARA rule detects the VanHelsing ransomware based on specific byte patterns associated with its file encryption routines, network enumeration capabilities, shadow copy deletion, and ransomware note dropping. The rule includes two main versions of the ransomware's functionality, indicating potential evolution or different variants.
This YARA rule detects the Skuld infostealer by identifying specific byte patterns associated with its functionalities. These functionalities include retrieving the MAC address of the infected system, enumerating files (likely for data collection), taking screenshots, and specifically targeting Discord backup codes. The rule looks for a combination of these distinct code patterns within a PE file (indicated by the MZ header).
Endpoint's that downloaded browser extensions
Find LNK files on certain devices
List all PnP Devices that have been allowed or blocked
Find all alert evidence for a single endpoint. This is handy for exporting to a third-party SIEM.
Detects the creation of temporary files with specific naming conventions (8 alphanumeric characters followed by '.tmp') in the 'C:\Windows\System32\' directory, when the creating process is 'svchost.exe'. This pattern is indicative of remote credential dumping activity often associated with tools like CrackMapExec and Impacket-secretsdump, which use svchost.exe to write temporary files containing dumped credentials.
Page 133 of 139