Sigma detection rules, expert-reviewed

Suspicious TeamViewer Remote Access DNS Resolution (via dns_query)

This rule detects DNS queries to TeamViewer infrastructure subdomains such as master, ping, router, and server nodes under teamviewer.com. Abuse of TeamViewer remote access enabled the Oldsmar water treatment facility intrusion where an operator workstation was manipulated remotely. TeamViewer is dual-use, so this detection is most valuable in ICS and OT segments where remote-access tooling should be absent or tightly controlled.

Suspicious Octo Tempest Remote Access and Tunneling Tooling (via process_creation)

This rule detects execution of remote monitoring and tunneling tools favored by Octo Tempest such as ScreenConnect Ngrok and Tailscale. The actor deployed these tools to maintain covert remote access and tunnel traffic out of victim networks.

Suspicious Chrome Remote Desktop Host Silent Binding for Remote Access (via process_creation)

This rule detects headless registration of a Chrome Remote Desktop host using the start host binary with authorization code redirect and pin arguments, the remote access tool abuse observed in a Kimsuky campaign to obtain interactive control of victim machines. Adversaries leverage legitimate remote desktop software to blend with sanctioned IT tooling while retaining hands on keyboard access, making early detection critical for exposing unauthorized remote sessions.

Suspicious NTFS Symbolic Link Evaluation Enabled via fsutil for Remote Access (via process_creation)

This rule detects fsutil enabling remote-to-local or remote-to-remote symbolic link evaluation, an uncommon configuration change made in the RansomHub intrusion to let symlinks resolve across hosts during propagation and encryption. Adversaries flip these SymlinkEvaluation settings to reach files through crafted links that are normally blocked, so this fsutil behavior change is a distinctive attacker-preparation indicator.

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

This rule detects the SimpleHelp Remote Access client spawning a command shell that runs account and domain enumeration utilities. Following exploitation of SimpleHelp RMM for initial access, operators used the persisted client to run net and nltest reconnaissance.

OpenCanary RDP New Connection Attempt on Application Logtype 14001

Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.

Windows MeshAgent Remote Access Tool Command Line Execution Indicators

Flags Windows processes invoking MeshAgent with --meshServiceName, indicating potential remote access tool execution.

macOS Process Creation: MeshAgent renamed execution via --meshServiceName

Identifies macOS executions of MeshAgent instances that include --meshServiceName, indicating potential renamed remote access tooling.

macOS Process Creation: MeshAgent Remote Access via --meshServiceName

Alerts on macOS process executions containing --meshServiceName, indicating potential MeshAgent remote access usage.

OpenCanary Telnet Login Attempt Recorded in Application Logs

Alerts on OpenCanary Telnet login attempt events to highlight potential remote access probing.

Windows SimpleService Execution via Remote Access Tool Wrapper Paths

Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.

Windows Network Connections to *.devtunnels.ms

Alerts on initiated Windows network connections to .devtunnels.ms hostnames, which may indicate remote access use.

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

Windows RDP Registry Settings Modified to Zero

Alerts when RDP-related registry values are set to 0, potentially weakening remote access controls.