Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects correlated host and geolocation reconnaissance (sw_vers, whoami, ioreg, system_profiler) executed in quick succession by a non-standard process and written to a system_info.json file, matching AmnesiaStealer's recon routine.
Process Spawns Multiple Recon Processes
Cortex XDR
Detect or threat hunt for a burst of Windows built-in discovery/reconnaissance utilities (Seven or more distinct tools within a single day) executed under one causality chain on one host, consistent with post-exploitation situational awareness by an interactive operator, script, or C2 implant.
Detects a read of /etc/os-release by a binary outside known system-utility paths, a precursor to the Rust-based RAT's host-fingerprinting telemetry; paired with a correlation rule requiring a subsequent outbound connection from the same binary to reduce noise.
Detects execution of whoami.exe as NT AUTHORITY\SYSTEM within a short window of, and parented by, a suspicious SYSTEM-privileged shell spawn — a common post-exploitation confirmation step following successful ShieldBreak exploitation. Standalone whoami execution is excluded by design.
This query identifies creation/loading of SysExcSvc.dll and SysReadSvc.dll along with suspicious LSASS memory dumping, reverse SSH tunnel creation.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
Detects correlated host-profiling reconnaissance by the DeviceManager RAT: three or more distinct indicators (MachineGuid, volume serial, user SID, AV product enumeration, domain/workgroup enumeration) executed within a 15-minute window from the same python.exe/pythonw.exe parent process.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
Detects host reconnaissance commands (e.g., pip freeze, id, hostname -I) spawned by processes whose command line references the malicious 'mrmustard' Python package. This links discovery activity directly to the context of the supply chain compromise.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects specific WebSocket JSON-formatted C2 agent registration and profiling traffic associated with the TAG-195/TinyEgg campaign. The rules look for specific registration markers (agent_register, request_register) and host profiling data (hostname, username, OS, domain, isAdmin status) characteristic of this threat actor's C2 communication.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects the execution of sequences of built-in administrative command-line tools often used by adversaries for system discovery and reconnaissance. The rule triggers on specific patterns of commands (e.g., WMI queries, system information gathering, or comprehensive user enumeration) that are frequently combined by attackers to understand the target environment.
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Page 4 of 16