Sigma detection rules, expert-reviewed

Malicious AnyDesk Unattended Silent Install and Password Set for Remote Access (via process_creation)

This rule detects AnyDesk being installed silently with start-with-win and then having an unattended access password set from the command line, the remote-access persistence pattern in the Fog intrusion where AnyDesk was dropped to ProgramData and configured for headless control. Adversaries stage AnyDesk this way to keep durable interactive access outside sanctioned RMM tooling, so a silent install paired with a scripted password set is a strong indicator.

Suspicious Remote Access Tool User Agent in Outbound Traffic via Proxy

This rule detects outbound HTTP requests carrying the NetSupport Manager or JWrapperDownloader user agents, network fingerprints of remote access tooling used during intrusions. Because these agents accompany download and command-and-control traffic for tools frequently abused as RATs, their presence in proxy logs indicates remote access tool activity that should be validated against sanctioned software.

Suspicious ScreenConnect Remote Access Binary Running Under a Renamed Executable

This rule detects a process whose original filename identifies it as ScreenConnect or SimpleHelp remote access software but whose on disk name has been changed which indicates masquerading to evade detection during phishing driven RMM abuse. Renaming remote support tools helps adversaries hide interactive access from defenders. Detecting the mismatch surfaces disguised remote access tooling.

Possible Remote Monitoring and Management Tool Abuse for Remote Access

This rule detects execution of remote monitoring and management tools including AnyDesk TeamViewer and NetSupport client32 that adversaries such as Storm-1811 abuse to gain hands on keyboard access after social engineering. These tools are legitimate but are frequently deployed by intruders to maintain interactive control of victim hosts. Detecting their execution supports baselining and hunting for unsanctioned remote access.

Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)

This rule detects a ScreenConnect remote-access client process spawning PowerShell or cmd, an abuse of legitimate remote-management software used by the Seashell Blizzard subgroup to run commands on compromised hosts during the BadPilot campaign. Because adversaries co-opt installed RMM tooling to blend into normal administration, scripting children of ScreenConnect warrant scrutiny in environments where such automation is not expected.

Suspicious Peach Sandstorm Remote Access via AnyDesk Tooling (via process_creation)

This rule detects execution of the AnyDesk remote access utility. Peach Sandstorm deployed AnyDesk alongside custom tunneling to maintain hands-on-keyboard access to compromised high-value targets.

Suspicious SimpleHelp Remote Access Tool Dropped In ProgramData Root

This rule detects the SimpleHelp remote-access binary access.exe executing from the root of the ProgramData directory, the drop location used by the actors exploiting CVE-2026-1731. Deploying a legitimate RMM tool from an unusual path gives the operator persistent hands-on access after exploitation. The ProgramData-root location distinguishes the malicious deployment from a normal install.

Suspicious PowerShell Spawned by ScreenConnect Remote Access Client

This rule detects PowerShell being launched as a child of the ScreenConnect remote access client, a lineage observed where actors abused legitimate RMM tooling to run follow-on scripts. While ScreenConnect is widely used for support, a scripting host spawned from its agent is a frequent hands-on-keyboard delivery pattern and merits scrutiny in environments where it is not sanctioned. Correlate with the downstream script content to confirm intent.

Suspicious AnyDesk Remote Access Tool Executed from ProgramData

This rule detects the AnyDesk remote access tool running from the C:\ProgramData directory, a deployment pattern used by threat actors targeting educational organizations to establish covert remote control as SYSTEM. Placing AnyDesk in ProgramData rather than its standard install path evades user notice. Unmanaged AnyDesk in this location indicates likely unauthorized remote access.

Silent AnyDesk Remote Access Tool Installation

This rule detects AnyDesk executed with an install flag, indicating an unattended deployment of the remote access tool. Huntress observed adversaries installing AnyDesk on compromised MSSQL servers to maintain hands-on access. Silent RMM installation on servers is a common attacker persistence and command-and-control technique that blends with legitimate remote support tooling.

Suspicious BeyondTrust Bomgar Process Spawning Remote Access Client (via process_creation)

This rule detects a BeyondTrust Bomgar process spawning a renamed SimpleHelp remote access binary. Operators abused the CVE-2026-1731 command-execution flaw to deploy SimpleHelp under the SYSTEM account as a secondary remote access foothold.

Suspicious RustDesk Remote Access Service Installation via sc (via process_creation)

This rule detects creation of a Windows service that launches RustDesk with an imported configuration. Akira ransomware operators installed RustDesk as an auto-start service using sc create to maintain unattended remote access to compromised hosts.

Malicious Scheduled Task ForceNetbirdRestart for Remote Access Persistence (via process_creation)

This rule detects creation of a scheduled task named ForceNetbirdRestart that restarts the NetBird agent after boot, a persistence behavior used by MuddyWater to keep its remote-access tunnel available. Adversaries leverage the task to guarantee the covert NetBird channel reconnects on every reboot.

Suspicious Silent AnyDesk Installation for Remote Access by DeadLock Ransomware

This rule detects silent unattended installation of AnyDesk configured to start with Windows. The DeadLock ransomware operators deploy AnyDesk as a covert remote access tool for persistence and hands-on control. Silent installation with automatic startup indicates the tool is being planted rather than installed by a user.

Antivirus Remote Access Tool Signature Matches Known RAT Names

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.