Every published rule

Windows Process Creation: ScreenConnect Service Execution

Alerts on Windows executions identified as ScreenConnect service/product/company strings, indicating potential remote access C2 activity.

Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling

Alerts on Windows process execution identified as “GoTo Opener” by LogMeIn, which may indicate remote access tool use.

Windows: reg.exe Adds Windows Defender Exclusion Paths via Registry Value Update

Detects reg.exe commands that modify Windows Defender/Microsoft Antimalware exclusion path registry entries.

Windows esentutl.exe Browser Data Collection via -r and WebCache path

Flags esentutl.exe runs with -r and WebCache references, indicating potential browser data collection.

Windows File Creation of ScreenConnect Temporary Installation Artefact

Flags Windows file events referencing temporary ScreenConnect artefacts under the \Bin\ScreenConnect.* path.

GoToAssist Temporary File Drop in Windows Temp Directory

Flags creation of GoToAssist Remote Support Expert temp installation artefacts under Windows AppData\Temp.

Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command

Flags schtasks.exe scheduling that triggers PowerShell to decode a base64 payload pulled from Windows Registry.

Windows reg.exe Used to Modify RDP Terminal Server Registry Values

Flags reg.exe command lines that modify Terminal Server registry values controlling RDP enablement and behavior.

PowerShell DirectorySearcher AD Computer Enumeration via System.DirectoryServices.DirectorySearcher

Flags PowerShell DirectorySearcher queries that load directory properties and enumerate results from Active Directory.

Windows process creation: flag suspicious program names and PowerShell script indicators

Alerts on suspicious Windows process image names and PowerShell command-line script/tool patterns commonly used in malicious tooling.

Windows LogMeIn LMIGuardianSvc Execution Associated with Remote Access Tools

Flags Windows process launches identified as LogMeIn LMIGuardianSvc by Description/Product/Company attributes.

AnyDesk Executable Execution on Windows

Detects AnyDesk-related process launches on Windows by matching executable names and AnyDesk product metadata.

Windows File Creation Indicators for Local SAM Database Exports

Alerts on Windows file creations with filenames indicative of a local SAM export or backup artifact.

Windows Recent Files Shortcut Points to ISO/IMG/VHD Mount Images

Flags Windows Recent Items entries that reference ISO/IMG/VHD/VHDX mount shortcuts.

Windows File Events: AnyDesk user.conf and system.conf Temporary Artefacts

Identifies Windows file writes of AnyDesk user.conf or system.conf in AppData\Roaming.

Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)

Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.

Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes

Alerts on Windows processes attempting to access lsass.exe from TrolleyExpress.exe, ProcessDump.exe, or dump64.exe with dump-like access rights.

Windows LSASS Memory Access Triggered by Source Image Containing 'dump' Keyword

Alerts when a process named with 'dump' requests specific access rights to lsass.exe on Windows.

Windows Script Interpreter Execution From Suspicious Folders via Command-Line Flags

Flags-and-location-based detection of cscript/wscript/mshta-style script execution launched from TEMP/Public/user directories.

Windows Process Command Line Network Recon via nslookup LDAP SRV Query

Identifies Windows command lines running nslookup with an LDAP SRV domain controller discovery query string.