Browse Rules

Search and filter across all detection sources

419 rules

hayabusa low sigma

Mstsc.EXE Execution With Local RDP File

Detects potential RDP connection via Mstsc using a local ".rdp" file
sigma low sigma

Mstsc.EXE Execution With Local RDP File

Detects potential RDP connection via Mstsc using a local ".rdp" file
signature-base unknown yara

rdrbs084 [yara]

Webshells Auto-generated - file rdrbs084.exe
signature-base unknown yara

rdrbs100 [yara]

Webshells Auto-generated - file rdrbs100.exe
yara unknown yara

rat_rdp [capabilities]

Remote Administration toolkit enable RDP
yara unknown yara

rdrbs084 [webshells]

Webshells Auto-generated - file rdrbs084.exe
yara unknown yara

rdrbs100 [webshells]

Webshells Auto-generated - file rdrbs100.exe
hayabusa low sigma

Mstsc.EXE Execution With Local RDP File

Detects potential RDP connection via Mstsc using a local ".rdp" file
sagan medium other

[EXTRAHOP] DoublePulsar RDP Implant

[EXTRAHOP] DoublePulsar RDP Implant
sagan medium other

[EXTRAHOP] DoublePulsar RDP Scan

[EXTRAHOP] DoublePulsar RDP Scan
sagan medium other

[EXTRAHOP] RDP Brute Force

[EXTRAHOP] RDP Brute Force
hayabusa medium sigma

Allow RDP Remote Assistance Feature

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
sigma medium sigma

Allow RDP Remote Assistance Feature

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
hayabusa medium sigma

Allow RDP Remote Assistance Feature

Detect enable rdp feature to allow specific user to rdp connect on the targeted machine
sigma high sigma

Publicly Accessible RDP Service

Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.

sagan informational other

[AWS] RDS Copy DB Snapshot

[AWS] RDS Copy DB Snapshot
sagan informational other

[AWS] RDS Delete DB Snapshot

[AWS] RDS Delete DB Snapshot
sagan informational other

[AWS] RDS Describe DB Snapshots

[AWS] RDS Describe DB Snapshots
sagan medium other

[DYNAMIC] AWS RDS Logs Detected

[DYNAMIC] AWS RDS Logs Detected
sagan medium other

[EXTRAHOP] New Outbound RDP Connection

[EXTRAHOP] New Outbound RDP Connection
sagan medium other

[EXTRAHOP] RDP Attack Tool Activity

[EXTRAHOP] RDP Attack Tool Activity
sagan medium other

[EXTRAHOP] RDP Session Enumeration Attempt

[EXTRAHOP] RDP Session Enumeration Attempt
sagan medium other

[EXTRAHOP] Spike in RDP Sessions

[EXTRAHOP] Spike in RDP Sessions
sagan informational other

[GCP-SCC] Allow RDP Port

[GCP-SCC] Allow RDP Port
sagan informational other

[GCP-SCC] Allow RDP Port

[GCP-SCC] Allow RDP Port