Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
883 detections
Filters
Last updated
All Time
Detection languages
444
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,443
11,831
5,875
5,151
4,864
883
Platforms
596
135
116
72
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
264
223
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This rule specifically looks for the `TeamViewer_Desktop` process being launched by `TeamViewer_Service` with specific command-line arguments, indicating a remote connection. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
The following KQL query focuses on detecting cases where files are created, modified, or otherwise accessed via RDP from another computer. Its main objective is to verify whether, during an RDP session, the connection has mapped a local disk or other redirected device — allowing us to easily identify potential cases of data exfiltration through RDP file transfer
Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This specific command line indicates that TeamViewer_Desktop.exe is being launched by TeamViewer_Service.exe with an IPC port of 5939 and module 1, which is characteristic of a remote connection being established. An investigator can verify connection details by reviewing the "incoming_connections.txt" log file in the TeamViewer folder.
This detection identifies SSH being enabled on ESXi hosts. Enabling SSH on ESXi can be an early indicator of malicious activity, as threat actors often use SSH to gain persistent remote access after compromising credentials or exploiting vulnerabilities. The rule specifically looks for syslog messages indicating that SSH access has been enabled.
Detects network connections initiated by Microsoft Quick Assist (QuickAssist.exe) to its official relay server. This activity is expected for legitimate Quick Assist usage, but monitoring it can help identify unauthorized remote access or potential abuse of the tool.
The analytic detects the use of SSH to move laterally and execute a script or file on a remote host. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific SSH command-line parameters and URLs. This activity is significant as it may indicate an attacker attempting to execute remote commands or scripts, potentially leading to unauthorized access or control over additional systems. If confirmed malicious, this could result in lateral movement, privilege escalation, or the execution of malicious payloads, compromising the security of the network.
Detects M365 Copilot users accessing from multiple geographic locations to identify potential account compromise, credential sharing, or impossible travel patterns. The detection aggregates M365 Copilot Graph API events per user, calculating distinct cities and countries accessed, unique IP addresses, and the observation timeframe to compute a locations-per-day metric that measures geographic mobility. Users accessing Copilot from more than one city (cities_count > 1) are flagged and sorted by country and city diversity, surfacing accounts exhibiting anomalous geographic patterns that suggest compromised credentials being used from distributed locations or simultaneous access from impossible travel distances.
The analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment.
This rule detects VPN connections originating from countries that are not the user's usual work country. It leverages VPN logs, specifically Zscaler VPN logs, to identify active connections and compares the source IP's country with a lookup of the user's expected work country. Alerts are generated when a mismatch is found, indicating a potentially unauthorized or suspicious access attempt.
KQL Query
Detects Chaos C++ ransomware payloads based on known file hashes and unique embedded strings from the malware.
This analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. The rule compares observed process names with a list of known remote access software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects the installation and configuration of a TacticalRMM agent where specific command-line flags (--api, --auth, --client-id, --site-id, --agent-type) are used. This indicates the agent is being configured to connect to a particular RMM server with authentication and client/site identification. This activity could signify a threat actor attempting to register the agent with their own controlled RMM infrastructure for persistent remote access.
This rule identifies unusual activity from locations not previously observed for a user within a defined lookback period. It leverages Microsoft Entra ID (Azure AD) Behavior Analytics and SigninLogs to baseline legitimate user locations and filter out trusted devices/IPs. The rule flags unusual activity where the source IP location is new for the user and exceeds a configurable threshold of 'unusual' behavior indicators, while also excluding specified trusted countries.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
Page 37 of 43