Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
ScreenConnect - SlashAndGrab Exploitation Indicators
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
ScreenConnect - SlashAndGrab Exploitation Indicators
Using Splunk · Default · sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: ScreenConnect - SlashAndGrab Exploitation Indicators
id: 05164d17-8e11-4d7d-973e-9e4962436b87
status: test
description: |
Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect as reported Team Huntress
references:
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-02-23
tags:
- attack.defense-evasion
- detection.emerging-threats
logsource:
product: windows
category: file_event
detection:
selection:
- TargetFilename|contains|all:
- 'C:\Windows\Temp\ScreenConnect\'
- '\LB3.exe'
- TargetFilename|contains:
- 'C:\mpyutd.msi'
- 'C:\perflogs\RunSchedulerTaskOnce.ps1'
- 'C:\ProgramData\1.msi'
- 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mpyutd.msi'
- 'C:\ProgramData\update.dat'
- 'C:\Users\oldadmin\Documents\MilsoftConnect\Files\ta.exe'
- 'C:\Windows\Help\Help\SentinelAgentCore.dll'
- 'C:\Windows\Help\Help\SentinelUI.exe'
- 'C:\Windows\spsrv.exe'
- 'C:\Windows\Temp\svchost.exe'
condition: selection
falsepositives:
- Unknown
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules-emerging-threats/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml