Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects a cluster of common discovery commands (e.g., ipconfig, whoami, net group) being executed within a short 60-second window, suggesting automated enumeration behavior by an adversary.
Detects signs of access token manipulation and impersonation, including the use of 'runas' with saved credentials, suspicious PowerShell API calls for identity management, usage of known token-manipulation tools (e.g., incognito), and reconnaissance using 'whoami /priv'. These activities are indicative of privilege escalation attempts or lateral movement.
Detects instances where Node.js or NPM processes initiate common Windows discovery tools (e.g., systeminfo, whoami, tasklist, ipconfig, wmic). This behavior is often indicative of post-exploitation discovery or reconnaissance activity performed by an adversary utilizing an application or malicious script running within the Node.js runtime environment.
This rule detects instances where cmd.exe is spawned by unusual parent processes (pcl2bmp.exe, MediumInstStart.exe, or ctxmui.dll) and executes common reconnaissance commands. This pattern often indicates post-exploitation discovery activity following the execution of suspicious or illegitimate binary files.
Detects post-exploitation system discovery and reconnaissance commands performed by PeopleSoft service accounts (psoft, oracle, linuxadm) on Linux hosts. This activity aligns with observed techniques from the ShinyHunters CVE-2026-35273 campaign, where compromised service accounts were used to map the local environment.
This rule detects instances where the w3wp.exe (IIS worker process) spawns command-line interpreters like cmd.exe or powershell.exe, and these interpreters execute common discovery commands such as 'whoami', 'hostname', or 'ipconfig'. This behavior can indicate a web server compromise where an attacker is attempting to gain information about the compromised system or network.
Detects the execution of common system discovery utilities (whoami, ipconfig, net, etc.) by a process named 'setup.exe' originating from suspicious directories such as 'AppData\Local\Temp\' or 'Downloads'. This behavior is often indicative of automated reconnaissance following the initial execution of a potentially malicious installer or dropper.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects the execution of the 'finger.exe' utility when initiated by common scripting hosts or command shells. The 'finger' utility is an antiquated network protocol often used by adversaries for network information or user enumeration. Its execution from within script interpreters is highly atypical and likely indicates malicious reconnaissance activity.
Detects instances where svchost.exe (typically a system service host) is acting as the parent process to spawn reconnaissance utilities such as systeminfo.exe, wmic.exe, ipconfig.exe, or whoami.exe. This behavior is highly irregular as these utilities are typically invoked by users or administrative scripts, not system-level service processes, and may indicate process injection or malicious activity leveraging legitimate system processes.
Detects the execution of five specific Windows reconnaissance utilities (net.exe, nltest.exe, whoami.exe, ipconfig.exe, and systeminfo.exe) by the same parent process within a 60-second window. This behavior pattern is highly characteristic of an automated discovery phase during a post-exploitation engagement, where an actor attempts to quickly gather system and network environment information.
Detects instances where a Node.js process (e.g., node.exe) spawns standard system reconnaissance binaries such as whoami, hostname, systeminfo, ipconfig, or ifconfig. This behavior is indicative of malicious activity, specifically infostealer campaigns (like the Polymarket Trap / Miasma) that leverage npm postinstall scripts or other Node.js execution patterns to gather host and environment information from developer machines.
Detects the execution of common enumeration and discovery commands (e.g., cmd, powershell, tasklist, net, whoami) when launched by specific background services such as OneDrive Sync or Intel Audio Service. This behavior is atypical for these processes and may indicate process injection or unauthorized activity using legitimate service binaries as a proxy.
Detects execution of common discovery binaries (tasklist, netstat, ipconfig, net, whoami, query) when spawned by the filter manager utility (fltMC.exe) or its children, a behavior observed in the Red Lamassu JFMBackdoor post-compromise activity.
Detects the execution of the 'whoami' command when it is base64 encoded in the process command line. This technique is often used by adversaries to discover system user information while attempting to evade simple string-based detections.
Detects signs of access token manipulation and impersonation, including the use of 'runas' with saved credentials, suspicious PowerShell API calls for identity management, usage of known token-manipulation tools (e.g., incognito), and reconnaissance using 'whoami /priv'. These activities are indicative of privilege escalation attempts or lateral movement.
Detects malicious node.exe processes engaging in system, user, process, or network discovery behaviors. This behavior is indicative of malicious npm packages, such as those seen in the Polymarket Trap, Miasma, or MYRA campaigns, which perform reconnaissance before attempting credential exfiltration.
This rule monitors for successful external logins occurring on an endpoint that previously demonstrated patterns of suspected MFA fatigue (multiple failed push notifications) and subsequent internal reconnaissance activity (execution of commands used for domain or system discovery). The rule correlates these events to identify potential compromised credentials being actively used for lateral movement or persistence.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects reconnaissance and C2 registration activity associated with the BeepRAT (DcRAT-derived) malware. The rule correlates registry queries, process execution (e.g., wmic, whoami, systeminfo), and file system activity related to the TCC loader chain, specifically focusing on how the implant gathers system hardware and user information to construct a unique client ID for command and control.
Detects a post-compromise reconnaissance burst associated with BeepRAT, where a process running from a suspicious directory (AppData, Temp, or ProgramData) executes five or more system discovery commands within a 60-second window, following the creation of a scheduled task on the same host.
Page 6 of 16