Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
18
11
7
6
Contributors
34
25
14
11
11
Categories
80
44
39
36
33
Platforms
127
7
2
1
Products / Services
72
17
13
8
6
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
10
9
IDS Classtypes
2
1
IDS Protocols
2
1
Detects silent MSI installations that drop specific DLLs (autorun.dll or vcredist_x64.dll) and subsequently spawn a ScreenConnect client service within a 5-minute window. This behavior is indicative of potential persistence or remote access tool deployment.
Detects network traffic to known Storm-2949 ScreenConnect infrastructure IPs. This rule identifies outbound network connections from devices to specific IP addresses associated with command and control (C2) infrastructure used by the Storm-2949 threat group, leveraging ScreenConnect for remote access.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Identifies the creation of scheduled tasks for Windows System Health Monitor persistence, specifically looking for 'schtasks.exe' creating tasks with names like 'Windows System Health Monitor' or 'Windows System Health Check', in conjunction with 'RuntimeHost.exe' activity. This pattern is indicative of cryptojacking campaigns abusing ScreenConnect.
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
Detects the malicious ScreenConnect module beaconing to attacker-controlled C2 infrastructure on custom ports 5443/8041. This rule specifically looks for network connections initiated by a process identified as 'ScreenConnect' to these non-standard ports, indicating potential command and control activity.
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
Detects sc.exe creating a Windows service named OneDriveServers to mask ScreenConnect persistence, as observed in Operation SilentCanvas.
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
This rule detects when the ScreenConnect process accesses DPAPI-related files, specifically those within the 'Protect\S-1-5-21-' folder. This activity is indicative of credential theft, as observed in the 'Operation SilentCanvas' campaign where a trojanized ScreenConnect was used for this purpose.
This rule detects the execution of ScreenConnect, a remote access tool, directly spawned by ComputerDefaults.exe. This behavior is indicative of a UAC bypass technique, specifically observed in the 'Operation SilentCanvas' campaign.
Detects the execution of an executable from the temporary ScreenConnect application directory. This behavior has been observed in recent malvertising campaigns where rogue ScreenConnect instances are used to deploy and execute multi-stage crypters (e.g., FatMalloc/crypteds.exe) from this directory, initiating ransomware and BYOVD payloads.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
Page 4 of 7