Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
330 detections
Filters
Last updated
All Time
Detection languages
146
74
28
25
16
Contributors
68
49
47
30
19
Categories
224
210
37
27
26
Platforms
272
78
33
18
4
Products / Services
91
82
44
23
23
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
2
1
1
1
IDS Classtypes
8
2
IDS Protocols
4
4
1
1
Detects potential MuddyWater APT activity involving the use of mshta for execution, PowerShell for system information discovery (operating system, network configuration, security center), and a PowerShell-based backdoor with base64 encoding and web requests.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
This rule detects attempts to enumerate local network configuration on Linux systems. It specifically looks for the execution of common network utilities such as 'firewall-cmd', 'ufw', 'iptables', 'netstat', 'ss', 'ip', 'ifconfig', 'systemd-resolve', and 'route'. Additionally, it triggers if '/etc/resolv.conf' is present in the command line, indicating an attempt to inspect DNS resolver configuration.
This rule detects attempts to discover DNS servers within a network using LDAP queries. Specifically, it looks for DNS queries where the query name starts with '_ldap.' and the query originates from an uncommon or suspicious application. The rule filters out queries from common system processes, known legitimate applications (like Microsoft Defender), and browsers to reduce false positives. The intent is to identify adversaries performing reconnaissance to map out network infrastructure.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
Detects the execution of the 'echo' command with the '%userdomain%' environment variable. This activity can be used by adversaries to enumerate the domain a user is associated with, which is a common discovery technique.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
Detects the execution of PowerShell cmdlets 'Get-NetFirewallRule' or 'Show-NetFirewallRule' to enumerate local firewall rules on a host. This activity is often performed by adversaries during the discovery phase to understand network configurations and potential egress/ingress points.
Detects the execution of 'nltest.exe', a Windows command-line utility that can be used by adversaries for information discovery, specifically to enumerate domain trusts and discover system network configurations.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detects DNS server discovery via LDAP query requests from uncommon applications
Nltest.EXE Execution
Sigma
Detects nltest commands that can be used for information discovery
Detects nltest commands that can be used for information discovery
Detects enumeration of local network configuration
Page 16 of 16