External Remote Services detection rulesT1133

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

windows

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

opencanary · application

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

opencanary · application

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

windows · process_creation

Running Chrome VPN Extensions via the Registry install 2 vpn extension

windows · registry_set

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual.

windows · file_event

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

windows · process_creation

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

windows · file_delete

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

windows · file_change

Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

windows · process_creation

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

windows

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

windows

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

fortigate

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

fortigate

Detects ScreenConnect program starts that establish a remote access to a system.

windows · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

linux · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

macos · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

windows · process_creation