Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.
This rule detects potential adversary reconnaissance behavior by identifying hosts executing a combination of common system and network enumeration commands (id, uname, hostname, ifconfig/ip) in short succession. Detecting multiple distinct reconnaissance commands from a single process context may indicate an interactive shell session being used to gather information about the environment.
Detects the execution of multiple system discovery utilities (systeminfo, wmic, ipconfig, net, arp, tasklist) originating from non-standard or suspicious directories (such as temp, appdata, or user directories). This behavior is often indicative of an adversary performing automated reconnaissance or discovery after gaining initial access.
Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.
Detects the BQTLock (BaqiyatLock) ransomware executing various system and network discovery commands such as systeminfo, ipconfig, and whoami from its main process (BQT.exe). These actions are indicative of pre-encryption reconnaissance used to profile the host environment before malicious file encryption commences.
Detects the execution of 'whoami' via 'cmd.exe' where the parent process is not a standard Windows system process or a known application path. This pattern is often indicative of reconnaissance or post-exploitation activity where an attacker attempts to identify the current user context.
This rule detects anomalous RDP (Logon Type 10) sessions occurring outside of typical business hours or from previously unseen geographic locations, followed closely by the execution of system discovery commands (net.exe, ipconfig.exe, whoami.exe, systeminfo.exe) within a 10-minute window. This behavior is indicative of post-exploitation reconnaissance following an unauthorized or suspicious remote access session.
Detects the execution of common reconnaissance or command-line utilities (e.g., whoami, net, powershell, cmd) spawned by the IIS worker process (w3wp.exe). This pattern is a strong indicator of post-exploitation activity or web shell usage on a compromised web server.
Detects the execution of the 'whoami' command via cmd.exe initiated with High integrity. This behavior is often associated with discovery efforts by adversaries operating with elevated privileges to identify the current user context.
Detects potential privilege escalation activity including manual privilege discovery using 'whoami /priv', suspicious elevated processes spawned from non-elevated parents, and specific scheduled task execution patterns associated with Payouts King malware.
Detects the execution of system information discovery utilities (systeminfo, ipconfig, whoami, net) by specific process names (BQT.exe or start.exe), followed by a DNS request to api.telegram.org within a 30-minute window. This behavior is indicative of malware performing reconnaissance and using Telegram for command and control or data exfiltration.
Detects a burst of reconnaissance activity typical of the StrikeShark toolkit, where an adversary executes four or more distinct system enumeration commands (systeminfo, whoami, ipconfig, net view, hostname, nltest, arp) from the same host and parent process within a 120-second window. The rule excludes common system management process lineages to reduce noise.
Detects the execution of 'whoami' via 'cmd.exe' when the parent process is suspicious, such as running from an AppData folder, originating from a suspicious directory named 'Liu5GgJiKiKqe2Qs', or when 'svchost.exe' is executed outside of the standard 'System32' directory. This pattern is commonly used for UAC elevation checks or reconnaissance by malicious software.
Detects execution of WMI queries against Win32_OperatingSystem and CIM_Memory classes by processes identified as associated with BeepRAT (e.g., HFY.exe or processes within TCC paths). This behavior is characteristic of post-infection system enumeration, hardware ID generation, and environmental keying used in operations such as DragonClone.
Detects the execution of five specific Windows reconnaissance utilities (net.exe, nltest.exe, whoami.exe, ipconfig.exe, and systeminfo.exe) by the same parent process within a 60-second window. This behavior pattern is highly characteristic of an automated discovery phase during a post-exploitation engagement, where an actor attempts to quickly gather system and network environment information.
Detects reconnaissance activity originating from npm or Node.js processes, specifically targeting system information (OS, network, user context, and hardware identifiers). This activity is associated with supply chain compromise attempts where malicious npm postinstall scripts or inline Node.js execution are used to enumerate the host environment.
This rule detects anomalous RDP (Logon Type 10) sessions occurring outside of typical business hours or from previously unseen geographic locations, followed closely by the execution of system discovery commands (net.exe, ipconfig.exe, whoami.exe, systeminfo.exe) within a 10-minute window. This behavior is indicative of post-exploitation reconnaissance following an unauthorized or suspicious remote access session.
Page 5 of 16