Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
1
Contributors
2
2
1
1
1
Categories
7
4
1
1
1
Platforms
8
1
Products / Services
4
3
3
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
Detects specific process behavior observed with Devil Bait malware samples. This rule identifies the execution of 'cmd.exe' as a child process of 'wscript.exe', attempting to redirect output to an XML or TXT file within the APPDATA\Microsoft directory. Additionally, it looks for reconnaissance commands such as 'ipconfig /all', 'dir', 'systeminfo', and 'tasklist' executed via 'cmd.exe'. This combination of behaviors is indicative of Devil Bait malware performing initial system reconnaissance and data collection.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
The following analytic identifies system information discovery techniques, such as the execution of commands like `wmic qfe`, `systeminfo`, and `hostname`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often use these commands to gather system configuration details, which can aid in further exploitation. If confirmed malicious, this behavior could allow attackers to tailor their attacks based on the discovered system information, potentially leading to privilege escalation, persistence, or data exfiltration.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy_zebrocy.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.