Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
9
2
2
1
Contributors
4
3
2
1
1
Categories
14
5
4
1
1
Platforms
14
1
Products / Services
6
4
3
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
Detects the use of the Windows 'tasklist' utility or command execution via 'cmd.exe' when the command line includes strings associated with common debugging tools (e.g., windbg, x64dbg). This behavior may indicate an adversary checking for the presence of analysis tools or attempting to manipulate running processes, which is often associated with debugger evasion or malicious environment reconnaissance.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
Detects execution of 'tasklist.exe' when spawned by suspicious or unexpected parent processes, specifically flagging instances where the parent process resides in an AppData directory or originates from specific executables often leveraged by malicious actors. This behavior is indicative of system enumeration and discovery activity.
Detects enumeration of running processes for target reconnaissance
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
This rule detects instances where msiexec.exe, a legitimate Windows Installer utility, spawns discovery tools like wmic.exe or tasklist.exe. This behavior can be indicative of an adversary using msiexec.exe for proxy execution to gather system information, potentially bypassing security controls. The detection looks for wmic.exe or tasklist.exe being launched within a 2-minute window of msiexec.exe, with specific command-line arguments often used for process or system listing, and where msiexec.exe or cmd.exe is the initiating process or parent process.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
Detects specific process behavior observed with Devil Bait malware samples. This rule identifies the execution of 'cmd.exe' as a child process of 'wscript.exe', attempting to redirect output to an XML or TXT file within the APPDATA\Microsoft directory. Additionally, it looks for reconnaissance commands such as 'ipconfig /all', 'dir', 'systeminfo', and 'tasklist' executed via 'cmd.exe'. This combination of behaviors is indicative of Devil Bait malware performing initial system reconnaissance and data collection.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
Detects a sequence of commands associated with the anti-analysis techniques of the Stealit malware. Stealit executes specific wmic and tasklist commands in quick succession from a single parent process to check for debuggers, analysis tools, and virtual environments.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy_zebrocy.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.