Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
1
1
1
Platforms
2
Products / Services
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
This rule detects the execution of common Windows command-line utilities used for system network configuration discovery. Adversaries often use these commands to gather information about the network environment, including IP addresses, network interfaces, ARP tables, NetBIOS information, and routing tables. The specific commands monitored are 'ipconfig /all', 'netsh interface show interface', 'arp -a', 'nbtstat -n', 'net config', and 'route print'.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
