Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
55
54
11
10
7
Contributors
46
30
17
7
6
Categories
85
63
41
30
13
Platforms
138
9
9
3
2
Products / Services
44
28
25
19
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
This rule detects the use of common Windows utilities and PowerShell commands for process discovery, such as tasklist.exe, wmic.exe, and Get-Process. It also flags execution of command lines containing references to known antivirus, EDR, or security agent process names, which is a common indicator of an adversary attempting to identify or disable security tools.
Detects suspicious discovery commands often used by adversaries for environmental reconnaissance, including querying security product status via WMIC, enumerating installed software, or executing tasklist.exe from non-standard system paths.
Detects reconnaissance activities performed by system binaries (wmic.exe, reg.exe, tasklist.exe) that are commonly used to enumerate security software, registry keys, and system configuration. Additionally, it alerts on any of these tools being spawned by processes originating from the ProgramData\Remcos directory, which is a known indicator of the Remcos Remote Access Trojan (RAT).
Detects information stealer malware, such as LokiBot or StealC, attempting to enumerate installed security software, firewall configurations, and system services. The rule monitors for WMI queries to 'SecurityCenter2' or registry enumeration of uninstallation/service keys originating from processes executing within user-writable, high-risk directories such as Temp, Downloads, or ProgramData, while filtering out known legitimate system processes.
Hunting rule loosely based off of Atomic Red Team T1518.001 test "Get Windows Defender exclusion settings using WMIC". No public in-the-wild intel reference available; correlate before alerting.
Detects reconnaissance activities performed on compromised web servers, including the enumeration of installed security software, installed applications via WMI or registry queries, and service/process listing. These actions are often observed as a precursor to defense impairment or further exploitation originating from web server processes like w3wp.exe.
Detects instances where a process executes multiple system enumeration commands (Defender status, service query, product enumeration, or process listing) within a short window, often associated with reconnaissance activity.
Detects the use of wmic.exe or PowerShell to query the WMI 'SecurityCenter2' namespace for 'AntiVirusProduct' information. This is a common discovery technique used by adversaries to identify installed security software to assess their environment before launching payloads.
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Detects reconnaissance activities targeting host-based security configurations, including AppLocker policies, Windows security features via registry keys, and endpoint security product status via WMI. These actions are common in the early stages of an attack to understand the environment's defensive posture.
Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects VBScript-driven reconnaissance using wscript.exe that executes WMI queries to enumerate running processes via Win32_Process or identifies installed antivirus products via the SecurityCenter2 namespace. This behavior is often associated with early-stage malware reconnaissance activities.
Detects the use of reg.exe to query the Windows registry for information related to software versions or service configurations. This activity is often associated with discovery efforts to identify installed software, system configuration, or potential security controls.
Detects the DRAYN malware enumerating security software by querying the registry key associated with the Advanced Monitoring Agent. This behavior is indicative of an adversary performing discovery to identify installed security tools on a compromised system.
Detects reconnaissance and impairment attempts against security software (EDR, AV, backup) using WMI or taskkill/net commands. The rule specifically monitors for these actions when executed by processes originating from user-writable directories, a technique commonly associated with the Grixba infostealer dropped by Play Ransomware.
Detects the Amadey loader or StealC information stealer performing situational awareness by enumerating security software via WMI queries for 'AntiVirusProduct'. This behavior is typical of malware attempting to identify and evade defensive tools.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
This rule detects potential DcRAT initial beaconing by correlating WMI 'AntiVirusProduct' enumeration with subsequent outbound network connections to known DcRAT C2 infrastructure within a short time window. This behavior is indicative of a post-exploitation reconnaissance phase followed by initial callback.
Identifies JScript payloads leveraging wmiprvse.exe to query SecurityCenter2 and enumerate installed endpoint protection products, often associated with SocGholish activity.
Detects reconnaissance activities targeting host-based security configurations, including AppLocker policies, Windows security features via registry keys, and endpoint security product status via WMI. These actions are common in the early stages of an attack to understand the environment's defensive posture.
Page 4 of 8