Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects execution of common discovery utilities (whoami, ipconfig, net, etc.) by the suspicious process 'MediumInstStart.exe', often indicative of an adversary performing reconnaissance after initial access or persistence.
Detects the MINIRECON implant performing reconnaissance activities, including sensitive directory listing and system information gathering. The rule monitors specific sideloaded process names such as 'pcl2bmp.exe' or 'Project Proposal.exe' as they execute discovery commands like 'dir /s', 'systeminfo', 'ipconfig', and 'whoami'.
Detects system enumeration commands executed via web shell context
This rule detects the execution of multiple system and file discovery commands within a short timeframe, which can be indicative of an adversary performing reconnaissance. The rule specifically looks for common Windows commands like 'systeminfo', 'whoami', 'ipconfig', 'net', 'tasklist', 'net user', 'net localgroup', 'wmic os get', 'wmic product get name', 'dir /s', 'Get-ChildItem', and 'Get-Process' executed via cmd.exe, powershell.exe, or wmic.exe. It triggers if at least 3 commands are executed or if at least 2 distinct tools are used within an hour.
Detects the execution of common reconnaissance and discovery tools on Windows systems, including network and domain trust enumeration tools, and system information utilities. This rule alerts on suspicious usage of binaries like fscan, SharpGPOAbuse, and administrative commands (net, nltest, whoami, ipconfig) used to gather information about the environment, domain trusts, or local system configuration.
Detects enumeration of logged-in users via net command
Detects the SNOWLIGHT dropper executing or loading modules as 'wusvc.exe' (a common masquerading name) from a user Downloads directory. This behavior is indicative of a reconnaissance phase where the dropper attempts to resolve 'GetUserNameA' from 'advapi32.dll' to identify the current system user.
Detects a sequence of reconnaissance commands (whoami, tasklist, systeminfo, netstat) executed by the command prompt and piped to a text file. This specific TTP was used in the Notepad++ supply chain attack to gather system information for exfiltration. The detection is scoped to specific AppData directories to reduce false positives.
This rule detects executable files being created or launched within the 'AppData\Local\Programs' directory by a temporary-stage process. This behavior is often indicative of malware attempting to establish persistence or execute from a user-specific location, leveraging temporary directories for initial execution or staging.
Detects a game-related child process collecting username, language, timezone, keyboard layout, and regional settings in one sequence. This rule specifically looks for command-line executions using 'cmd.exe', 'powershell.exe', or 'wmic.exe' that include commands like 'whoami', 'Get-WinSystemLocale', 'Get-TimeZone', 'Get-WinUserLanguageList', 'keyboard layout', or 'Win32_TimeZone'.
Detects the execution of discovery commands (e.g., whoami, tasklist, net user) spawned from the OneDrive.Sync.Service.exe process, consistent with behavior from the SPECTRALVIPER XGU module.
Detects the NUKESPED (zlrenu8.exe) implant performing post-compromise reconnaissance. This rule monitors for registry enumeration and modification, as well as the spawning of common system discovery processes (e.g., net.exe, tasklist.exe, systeminfo.exe) and the querying of specific registry keys related to OS version and computer identification.
Detects rapid, consecutive execution of commands or scripts to enumerate both the username and computername on a system within a 30-second window. This behavior is consistent with initial host fingerprinting often performed by adversaries, including techniques used by SHEETCREEP malware.
Detects instances where ColdFusion service processes or IIS worker processes (w3wp.exe) spawn common command-line interface tools or system enumeration utilities. This activity often indicates post-exploitation behavior, such as a web shell being used to execute commands, perform system discovery, or establish persistent re-access after initial remediation.
This rule detects a potential privilege escalation chain by identifying a sequence of common discovery commands (net.exe, whoami.exe, ipconfig.exe) followed within 30 minutes by process execution involving keywords related to administrative accounts or systems (admin, administrator, system) on the same host.
This rule detects a potential privilege escalation chain by identifying a sequence of common discovery commands (net.exe, whoami.exe, ipconfig.exe) followed within 30 minutes by process execution involving keywords related to administrative accounts or systems (admin, administrator, system) on the same host.
Detects a hidden PowerShell instance collecting hostname, user, domain, operating system, architecture, and security-product information. This behavior is indicative of reconnaissance activities often performed by malware like InstallFix.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
This rule detects suspicious reconnaissance patterns on Windows endpoints. It monitors for the execution of common discovery utilities (whoami, hostname, ipconfig, systeminfo) when they are either executed in a rapid sequence (more than 2 distinct tools within 5 minutes) or when they are launched from known suspicious parent processes commonly used for script execution and evasion (e.g., PowerShell, WScript, MSHTA, etc.).
This rule detects suspicious reconnaissance patterns on Windows endpoints. It monitors for the execution of common discovery utilities (whoami, hostname, ipconfig, systeminfo) when they are either executed in a rapid sequence (more than 2 distinct tools within 5 minutes) or when they are launched from known suspicious parent processes commonly used for script execution and evasion (e.g., PowerShell, WScript, MSHTA, etc.).
Detects the execution of common system discovery utilities (whoami, ipconfig, net, etc.) by a process named 'setup.exe' originating from suspicious directories such as 'AppData\Local\Temp\' or 'Downloads'. This behavior is often indicative of automated reconnaissance following the initial execution of a potentially malicious installer or dropper.
Page 7 of 16