Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
883 detections
Filters
Last updated
All Time
Detection languages
444
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,443
11,831
5,875
5,151
4,864
883
Platforms
596
135
116
72
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
264
223
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Detects the execution of RustDesk, a legitimate remote access tool, specifically when running with service or tray command-line arguments. This activity may indicate the installation of remote management capabilities by an adversary or authorized administrative activity.
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
Detects unusual SSH activity originating from or involving Cisco vManage systems, specifically monitoring outbound SSH connections to internal network segments (10.0.0.0/8) or the execution of SSH processes with command-line arguments indicative of management tasks (vsmart, vbond).
Detects potentially unauthorized or malicious behavior associated with the RustDesk remote access tool. The rule monitors for unsigned screen capture attempts, spawning of shell or scripting processes, cross-process input injection, and network communication over non-standard or unexpected ports.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Detects instances where the RustDesk remote control application spawns suspicious child processes, such as command interpreters or scripting utilities. This behavior is indicative of a permission bypass exploit, where an attacker leverages an existing authorized remote session to gain interactive command-line access or execute unauthorized commands on the target host.
This rule detects potentially unauthorized or suspicious Remote Desktop Protocol (RDP) activity by monitoring for instances of 'mstsc.exe' initiated with specific command-line arguments, or identifying child processes spawned by RDP-related binaries ('mstsc.exe', 'rdpclip.exe') that are not typically associated with standard RDP functionality.
Detects Azure Bastion RDP or SSH tunnel sessions initiated by users who have no history of using Bastion in the last 60 days, or by users connecting from a geographic location not observed in their recent sign-in history. This behavior may indicate account compromise and unauthorized lateral movement attempts.
Detects the execution of RemotePC (IDriveRemotePC.exe, RemotePC.exe, IDrive.exe) by common scripting or command-line interpreters (powershell.exe, cmd.exe, wscript.exe) with suspicious command-line arguments. This could indicate abuse of legitimate Remote Monitoring and Management (RMM) software for malicious purposes, such as by ransomware.
This rule detects the execution and network activity of known Remote Monitoring and Management (RMM) tools such as AnyDesk, TeamViewer, and ScreenConnect. It assigns a risk score based on whether the activity occurs outside of defined business hours (8 AM - 6 PM) and whether the tool is initiating an outbound connection on port 443, a common pattern for C2 communication.
This rule detects inbound Remote Desktop Protocol (RDP) connections (ports 3389, 3390, 3391) that are initiated by common scripting engines such as wscript.exe, cscript.exe, or powershell.exe. This behavior can be indicative of post-exploitation activity where an attacker uses scripts to establish remote access.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
Detects remote management software launched from an existing RDP session, indicating nested remote access or pivoting.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.
Detects the installation or execution of ScreenConnect originating from the Azure Run Command extension context. This indicates potential unauthorized remote access tool deployment.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects the execution of known remote access tools (e.g., AnyDesk, TeamViewer, RemotePC, IDriveRemotePC) from non-standard parent processes. This helps identify unauthorized or potentially malicious use of remote control software that bypasses standard application deployment or management processes.
Page 29 of 43