Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects reconnaissance commands related to system domain, locale, and environment settings following the execution of rnpkeys.exe from C:\ProgramData\keyroll, a behavior associated with the Sauron Loader. The rule identifies suspicious system discovery commands (nltest, whoami, etc.) or environment checks performed shortly after the loader's execution, indicating potential target verification before C2 registration.
Detects rapid execution of multiple discovery-related commands (whoami, tasklist, ipconfig, netstat, systeminfo) by common Windows host processes within a 15-minute window. This behavior often indicates an adversary performing reconnaissance after gaining an initial foothold.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects rapid execution of multiple native Windows discovery commands (whoami, ipconfig, hostname, tasklist) within a short window, which is often indicative of an adversary performing environment reconnaissance post-compromise.
Detects anomalous network traffic patterns from the legitimate 'rnpkeys.exe' process when side-loaded from the 'ProgramData\keyroll' directory. The rule specifically looks for a sequence of connections matching initial C2 registration (TLV 0x01) followed by consistent, periodic beaconing (TLV 0x02) at an interval indicating automated task polling, rather than single-connection legitimate activity.
Detects a rapid, multi-stage intrusion sequence on a single host involving discovery, lateral movement, and high-volume file modifications. The rule identifies anomalous behavior where diverse reconnaissance and lateral movement commands are executed within a compressed timeframe, characteristic of automated or LLM-driven orchestration of ransomware operations.
Detects known persistence binaries or suspicious file paths associated with the CHOSEN BRICK threat actor executing common discovery commands such as tasklist, systeminfo, and process enumeration scripts. This pattern aligns with the post-compromise reconnaissance phase performed prior to further malicious activity.
Detects a cluster of host enumeration and system discovery commands (such as whoami, hostname, systeminfo, and network config queries) executed by the same process account within a short window, which is often indicative of post-exploitation reconnaissance.
Detects the execution of common discovery commands like 'whoami' combined with system information gathering commands (tasklist, ver, uname) when initiated by an application named 'pc-app.exe'. This pattern is frequently observed during the reconnaissance phase of an attack.
Detects network communication to known malicious infrastructure associated with the GRAYRABBIT malware campaign. The rule correlates TCP connections on port 443 to the domain 'mail.uaiubifas.top' with process events attempting to discover system and user information (GetAdaptersAddresses, gethostname, GetUserNameA), which is characteristic of the malware's initial beaconing behavior.
Detects the execution of common discovery commands like 'whoami' combined with system information gathering commands (tasklist, ver, uname) when initiated by an application named 'pc-app.exe'. This pattern is frequently observed during the reconnaissance phase of an attack.
Detects the execution of common discovery commands like 'whoami' combined with system information gathering commands (tasklist, ver, uname) when initiated by an application named 'pc-app.exe'. This pattern is frequently observed during the reconnaissance phase of an attack.
Detects network communication to known malicious infrastructure associated with the GRAYRABBIT malware campaign. The rule correlates TCP connections on port 443 to the domain 'mail.uaiubifas.top' with process events attempting to discover system and user information (GetAdaptersAddresses, gethostname, GetUserNameA), which is characteristic of the malware's initial beaconing behavior.
This rule detects suspicious command executions (e.g., whoami, downloadstring, iex, registry modifications) initiated by processes associated with the CrowdStrike Falcon agent. It also correlates these executions with the loading of unsigned or unverifiable DLLs by the same Falcon processes within a 5-minute window, which may indicate attempts to tamper with or masquerade as the security agent.
Detects the execution of common discovery commands like 'whoami' combined with system information gathering commands (tasklist, ver, uname) when initiated by an application named 'pc-app.exe'. This pattern is frequently observed during the reconnaissance phase of an attack.
Detects host and user discovery commands (whoami, hostname, systeminfo, wmic) executed within a 15-minute window following a suspected CRPx0 ransomware execution event, identified by either encoded PowerShell or curl-to-bash activity.
Detects execution of common reconnaissance and system discovery commands (e.g., whoami, netstat, ifconfig) initiated by web server or application runtime processes (e.g., httpd, nginx, tomcat, node). This behavior is highly indicative of post-exploitation activity where an adversary attempts to gather system or network information after successfully compromising a web-based service.
This rule detects suspicious command executions (e.g., whoami, downloadstring, iex, registry modifications) initiated by processes associated with the CrowdStrike Falcon agent. It also correlates these executions with the loading of unsigned or unverifiable DLLs by the same Falcon processes within a 5-minute window, which may indicate attempts to tamper with or masquerade as the security agent.
Page 2 of 16