Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
31
26
6
4
3
Contributors
21
15
9
7
3
Categories
50
47
10
5
5
Platforms
61
8
4
3
Products / Services
18
16
14
7
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
1
IDS Protocols
2
1
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
Detects the execution of the 'crontab -l' command, which is used to list scheduled cron jobs for the current user. This activity can be part of discovery tactics by adversaries to understand the system's scheduled tasks.
This rule detects PowerShell scripts that perform potential registry reconnaissance. Specifically, it looks for the use of PowerShell cmdlets like 'Get-Item', 'gci', or 'Get-ChildItem' in conjunction with specific registry paths known to contain system configuration, service information, or autostart entries. Adversaries often query these registry keys to gather information about the system's credentials, configuration, and installed software, which can aid in further compromise or privilege escalation.
Detects the execution of 'sc.exe' with the 'query' command-line argument to gather information about registered services on a Windows system. This activity can be indicative of discovery efforts by an attacker.
Detects the usage of 'reg.exe' to query reconnaissance information from the Windows registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software, specifically looking for common persistence mechanisms and service configurations.
This rule detects the execution of 'wmic.exe' with command-line arguments indicating a query for service information. Adversaries may use WMIC to perform reconnaissance on remote systems, checking for the existence and status of specific services. The rule specifically looks for 'wmic.exe' or 'WMIC.exe' in the image name or original file name, combined with the presence of 'service' in the command line.
Crontab Enumeration
Sigma
Detects usage of crontab to list the tasks of the user
Page 4 of 4