Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects the execution of the 'whoami' utility with flags that enumerate user privileges or information ('/all', '/priv'), when initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is commonly associated with attackers performing discovery after gaining a foothold on a system.
Detects the execution of the 'whoami' utility with flags that enumerate user privileges or information ('/all', '/priv'), when initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This behavior is commonly associated with attackers performing discovery after gaining a foothold on a system.
Detects reconnaissance activity where PowerShell scripts named 'lightlife.ps1' or 'Update.ps1' execute common Windows system information discovery commands such as systeminfo, whoami, hostname, and wmic. This activity is indicative of the Lightlife RAT performing post-exploitation host enumeration.
This rule monitors for successful external logins occurring on an endpoint that previously demonstrated patterns of suspected MFA fatigue (multiple failed push notifications) and subsequent internal reconnaissance activity (execution of commands used for domain or system discovery). The rule correlates these events to identify potential compromised credentials being actively used for lateral movement or persistence.
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
Detects the SNOWLIGHT dropper process (masquerading as wusvc.exe) dynamically loading advapi32.dll and invoking GetUserNameA via hash-based API resolution. This behavior is indicative of malware performing system owner/user discovery.
Detects post-compromise reconnaissance activity characterized by a rapid burst of native Windows tool executions (whoami, net, ipconfig, systeminfo, nltest, wmic) or PowerShell commands used for discovery. The rule triggers when a threshold of 3 distinct reconnaissance activities is met within a 30-minute window on a single device, helping to identify potential lateral movement or internal network mapping by an adversary.
Detects the execution of reconnaissance commands (whoami, ipconfig, net group) via PowerShell that also include either specific internal IP address patterns or curl-based exfiltration patterns, suggesting potential adversary activity.
Detects common reconnaissance or discovery commands (systeminfo, wmic, whoami, hostname, ipconfig, tasklist) when spawned by the Service Host process (svchost.exe). Legitimate system processes should typically not spawn these administrative tools directly; this behavior is frequently indicative of post-exploitation discovery activities.
This rule detects the creation of common reconnaissance and shell utilities (whoami.exe, hostname.exe, ipconfig.exe, cmd.exe, powershell.exe) by the IIS worker process (w3wp.exe) on Windows systems. This activity is often indicative of a web application compromise, such as a SharePoint vulnerability (e.g., path traversal), where an attacker leverages the web server to execute system commands for discovery or further exploitation. The rule specifically targets Security Event ID 4688 (process creation) and filters for processes spawned by w3wp.exe.
This rule detects PowerShell or CMD processes executing host profiling and system discovery commands (e.g., whoami, hostname, systeminfo) that are initiated by processes linked to the 'lightlife.ps1' script or associated Lightlife RAT activity.
This rule detects the execution of 'envchk.exe' from common Windows temporary directories (e.g., C:\Windows\Temp\ or C:\Users\<User>\AppData\Local\Temp\). It then correlates this activity with subsequent executions of system profiling commands such as 'hostname.exe', 'ipconfig.exe', 'tasklist.exe', 'wmic.exe', 'powershell.exe', or 'reg.exe' within a 5-minute window. The detection specifically looks for command-line arguments indicative of system information gathering (e.g., 'getmac', 'Win32_Product', 'Get-Package', 'Get-Culture', 'Get-DnsClient', 'tasklist', 'hostname'). This sequence of events is characteristic of the environment-check stage of the DAEMON Tools backdoor campaign, aiming to identify the system's configuration and environment.
This rule detects potential container escape attempts on Linux systems by monitoring suspicious file system access patterns to the host's root directory or process creation events involving 'mount', 'nsenter', or 'chroot' commands with parameters indicative of host interaction. Specifically, it looks for file operations on '/proc/1/root', '/proc/1/cwd', '/proc/1/exe', '/proc/1/fd', '/proc/1/ns', '/proc/1/environ', '/proc/1/mounts' or paths starting with '/host', '/hostroot', '/host-root', '/node-root'. It also flags 'mount' commands targeting '/proc/1/root', '/proc/1', 'nsenter', '--target 1', 'hostpath', or '/host', 'nsenter' commands with namespace manipulation arguments, and 'chroot' commands targeting '/proc/1/root', '/host', or '/hostroot'. These activities are commonly associated with adversaries trying to break out of a containerized environment to gain access to the underlying host.
Detects command-line execution of 'cmd.exe' with specific arguments indicative of WMIExec reconnaissance, where the output of 'whoami' is redirected to a file within the '\Windows\Temp\' directory. This is a classic indicator associated with the Impacket toolkit's WMIExec functionality.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
This rule detects potential reconnaissance activity by monitoring for the execution of multiple system enumeration utilities (ipconfig, systeminfo, tasklist, net, whoami, nslookup) on the same device within a short 30-minute window. A threshold of 4 or more distinct tools triggered by the same device is used to identify suspicious behavior indicative of an attacker profiling a newly compromised host.
Local accounts, System Owner/User discovery using operating systems utilities
Detects malware checking environment variables before executing payload
Detects malware checking environment variables before executing payload
This YARA rule detects Portable Executable (PE) files associated with the Nimplant C2 framework. It identifies Nimplant by looking for specific DLL names (some with common typos), Nim-related source file names (e.g., pixle.nim, urls.nim), Windows API function calls commonly used by malware (e.g., GetComputerNameW, CreateProcess, VirtualProtect), Zlib patterns, TLS callbacks, and specific strings like registry keys and a version string "@NimPlant v1.4". The rule requires the file to be a valid PE file (MZ header).
Page 8 of 16