Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Detects instances where 'node.exe' executes 'protocal.cjs' from a 'NodePackages' path and subsequently spawns child processes that perform host reconnaissance activities. These activities include PowerShell registry queries, process listing, and querying installed applications, which are indicative of an adversary gathering system information.
This rule detects the execution of 'system_profiler' with command-line arguments 'SPMemoryDataType' or 'SPHardwareDataType'. This behavior is indicative of malware, specifically AMOS Stealer, attempting to enumerate system hardware and memory details to detect virtualized environments (e.g., QEMU, VMware) as an anti-analysis technique.
Detects a loader writing an encrypted data component and immediately querying hostname, processor, or volume identifiers used to derive a machine-specific decryption key. This behavior is indicative of malware, such as RokRAT, attempting to create a system-specific payload to evade detection or ensure persistence.
Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
This rule detects a rapid sequence of host profiling commands commonly used by the AMOS malware to gather system information, specifically to generate the hardware UUID of the victim machine. It looks for the execution of 'whoami', 'id', 'hostname', and 'ioreg' commands within a 10-second window, requiring at least three distinct commands from this set, with 'ioreg' being a mandatory component.
Identifies the payload invoking GetComputerNameExW and GetVolumeInformationW to generate the XOR-combined decimal victim ID. The rule specifically looks for these API calls made by a process named "Подтверждение заказа продукции ЦАИ.exe".
Detects enumeration of existing QoS policies via PowerShell, potentially used by attackers to verify throttling. This rule specifically looks for the execution of the 'Get-NetQosPolicy' command within PowerShell.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
Detects usage of common built-in tools (driverquery.exe, sc.exe) and PowerShell commands (Get-WindowsDriver, WMI queries for Win32_PnPSignedDriver or Win32_SystemDriver) used to enumerate installed system drivers. This is often part of reconnaissance to identify third-party drivers for BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects PowerShell executing specific WMI queries targeted at identifying video controllers or domain membership in a hidden, non-interactive window. This behavior is used by EtherRAT for sandbox evasion and system profiling post-compromise.
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
This rule detects potential reconnaissance activity by monitoring for the execution of multiple system enumeration utilities (ipconfig, systeminfo, tasklist, net, whoami, nslookup) on the same device within a short 30-minute window. A threshold of 4 or more distinct tools triggered by the same device is used to identify suspicious behavior indicative of an attacker profiling a newly compromised host.
Detects command-line utilities such as grep, cat, sed, awk, or shell commands (bash, sh) being used to read the 'psappsrv.cfg' file and specifically searching for sensitive configuration parameters like 'Address=', 'HostName=', 'appserv', 'prcs', or 'ps_config_homes'. This activity could indicate an attacker attempting to discover system information or network configurations related to Oracle PeopleSoft.
Detects inspection of active mounts or /etc/hosts for PeopleSoft, configuration home, NFS, or environment naming patterns. This rule specifically looks for commands like 'mount', 'cat', 'grep', 'bash', or 'sh' being executed with command-line arguments that include 'mount' and PeopleSoft-related terms ('psoft', 'ps_config', 'nfs'), or '/etc/hosts' with PeopleSoft-related terms ('psoft', 'csprd', 'peoplesoft', 'psft').
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,
and GPU driver products/versions.
Some of these commands were used by Aurora Stealer in late 2022/early 2023.
including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,
and GPU driver products/versions.
Some of these commands were used by Aurora Stealer in late 2022/early 2023.
An adversary might use WMI to discover information about the system, such as the volume name, size,
free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
Page 26 of 39