Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
KQL detects suspicious child processes launched by PHP or web-server workers following possible exploitation of CVE-2026-109618 or CVE-2026-109619.
Detects processes rapidly invoking multiple system and network reconnaissance APIs (such as NetGetJoinInformation, NetSessionEnum, GetAdaptersAddresses, etc.) within a short window, which is indicative of automated discovery or reconnaissance activity.
Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.
Detects web server processes (such as Apache, httpd, or PHP) spawning a Unix shell (sh, bash, dash) and executing discovery commands (such as id, hostname, uname) with output redirection to proof files or embedded in callback URLs via command substitution.
Detects web server processes (such as nginx, apache2, httpd, uwsgi, gunicorn, php-fpm) spawning command-line utilities typically used for system and user discovery (such as id, whoami, groups, hostname, uname, netstat, ps, etc.), which often indicates web application exploitation and remote code execution.
Detects when the IIS worker process (w3wp.exe) spawns common system and network discovery utilities such as whoami, ipconfig, systeminfo, net, and others, which may indicate web shell activity or post-exploitation discovery.
The following analytic detects the execution of the Windows OS tool quser.exe, commonly used to gather information about user sessions on a Remote Desktop Session Host server. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as quser.exe is often abused by post-exploitation tools like winpeas, used in ransomware attacks to enumerate user sessions. If confirmed malicious, attackers could leverage this information to further compromise the system, maintain persistence, or escalate privileges.
The following analytic detects the suspicious use of the whoami command, which may indicate an attacker trying to gather information about the current user account on a compromised system. The whoami command is commonly used to verify user privileges and identity, especially during initial stages of an attack to assess the level of access. By monitoring for unusual or unauthorized executions of whoami, this analytic helps in identifying potential reconnaissance activities, enabling security teams to take action before the attacker escalates privileges or conducts further malicious operations.
The following analytic detects the execution of `powershell.exe` with command-line arguments invoking the `GetCurrent` method of the WindowsIdentity .NET class. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use this method to identify the logged-in user on a compromised endpoint, aiding in situational awareness and Active Directory discovery. If confirmed malicious, this could allow attackers to gain insights into user context, potentially facilitating further exploitation and lateral movement within the network.
The following analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). This method identifies the current Windows user. The detection leverages PowerShell script block logs to identify when this method is called. This activity is significant because adversaries and Red Teams may use it to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this could allow attackers to map out user accounts and potentially escalate privileges or move laterally within the network.
The following analytic detects the execution of `query.exe` with command-line arguments aimed at discovering logged-in users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use `query.exe` to gain situational awareness and perform Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to identify active users, aiding in further lateral movement and privilege escalation within the network.
The following analytic detects the execution of `powershell.exe` with command-line arguments that use PowerShell environment variables to identify the current logged user. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this behavior could allow attackers to gather critical user information, aiding in further exploitation and lateral movement within the network.
The following analytic detects the use of PowerShell environment variables to identify the current logged user by leveraging PowerShell Script Block Logging (EventCode=4104). This method monitors script blocks containing `$env:UserName` or `[System.Environment]::UserName`. Identifying this activity is significant as adversaries and Red Teams may use it for situational awareness and Active Directory discovery on compromised endpoints. If confirmed malicious, this activity could allow attackers to gain insights into user context, aiding in further exploitation and lateral movement within the network.
Detects instances where the IIS worker process (w3wp.exe) spawns the Windows command shell (cmd.exe) to execute common reconnaissance commands such as whoami, hostname, systeminfo, and net user. This behavior is strongly indicative of post-exploitation activity following a successful web shell deployment on a web server.
Detects instances where the IIS worker process (w3wp.exe) spawns the Windows command shell (cmd.exe) to execute common reconnaissance commands such as whoami, hostname, systeminfo, and net user. This behavior is strongly indicative of post-exploitation activity following a successful web shell deployment on a web server.
Detects the execution of discovery or credential access utilities (e.g., whoami, net, reg, ldapsearch) spawned by Java-based server processes like java.exe or tomcat.exe. This activity is often indicative of an attacker leveraging a vulnerable web application to perform reconnaissance or credential harvesting on the host system.
Detects host enumeration activities (listing processes, user information, and directory contents) performed by known legitimate binaries (e.g., poedit.exe, curl.exe, vim.exe) shortly after they have executed a suspicious sideloading event. This pattern is characteristic of the NeedyMantis actor performing initial discovery before C2 beaconing.
This rule detects potential malicious activity where a non-browser process downloads a specific payload file from a suspicious domain ('easyllms.xyz') and is subsequently linked to process activity involving the discovery of system or user information (e.g., GetComputerNameA, GetUserNameA). This pattern is characteristic of a dropper or stage-one malware attempting to profile the compromised host.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Page 1 of 16