Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Use of hostname to get information
Nltest.EXE Execution
Sigma
Detects nltest commands that can be used for information discovery
Detects nltest commands that can be used for information discovery
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.
Detects the execution of whoami that has been renamed to a different name to avoid detection
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects usage of the "systeminfo" command to retrieve information
This rule detects the ChinaZ trojan by identifying specific byte patterns associated with its functionalities. These functionalities include collecting system information, sending system information, parsing C2 commands, and performing DNS flood attacks. The rule contains distinct byte patterns for both 32-bit and 64-bit architectures of the malware.
Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.
Detects when storage bucket is enumerated in Google Cloud.
Detects System Information Discovery commands
Detects the use of grep to discover specific files created by the GobRAT malware
Detects usage of system utilities to discover system network connections
Detects enumeration of local network configuration
Detects usage of system utilities to discover files and directories
Detects enumeration of local system groups
Detects the enumeration of other remote systems.
Detects usage of system utilities (only grep for now) to discover security software discovery
Detects usage of system utilities to discover system network connections
Page 192 of 203