Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
329 detections
Filters
Last updated
All Time
Detection languages
145
74
28
25
16
Contributors
68
49
47
30
19
Categories
222
208
37
27
26
Platforms
271
76
33
18
4
Products / Services
91
82
44
23
23
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
2
2
1
1
1
IDS Classtypes
8
2
IDS Protocols
4
4
1
1
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects rapid execution of multiple native Windows discovery commands (whoami, ipconfig, hostname, tasklist) within a short window, which is often indicative of an adversary performing environment reconnaissance post-compromise.
Detects common Windows command-line utilities used for internal network reconnaissance, including ARP cache queries, NetBIOS enumeration, SMB share/session discovery, and subnet ping sweeps. These techniques are frequently employed by adversaries for lateral movement preparation and internal network mapping.
Detects a sequence of PowerShell commands consistent with the VelvetCake reconnaissance module, including enumeration of antivirus software via SecurityCenter2, system information, IP configurations, running processes, recent files, and drive mapping within a short timeframe.
Detects malicious PowerShell scripts that perform a sequence of reconnaissance activities, including security product enumeration via WMI (SecurityCenter2), system configuration discovery (ipconfig, systeminfo), process enumeration, recent file access, and drive mapping. This behavior is indicative of second-stage reconnaissance by threat actors to map the target environment.
Detects rapid, multi-category system and network enumeration performed by AI-assisted development tools (e.g., Cursor, Claude, ChatGPT). The rule triggers when an AI agent process performs a comprehensive scan of the host environment, specifically covering machine/OS identity, network configuration, process listings, installed software, and access to sensitive credential files within a 10-minute window. It requires at least 5 distinct discovery categories and 6 total events to reduce noise from routine debugging. Covers T1082, T1016, T1057, T1518
Detects non-standard processes loading the iphlpapi.dll library and subsequently executing commands related to ARP network discovery, such as GetBSSID, SendARP, GetDefaultGateway, or GetAllNetworkInterfaces. This behavior is characteristic of network reconnaissance and fingerprinting activities often employed by information stealers like Hannibal Stealer.
Detects the execution of SoftPerfect Network Scanner (netscan.exe), a tool frequently utilized by threat actors such as Ransom Busters for internal network reconnaissance and host discovery activities prior to lateral movement or data exfiltration.
Detects the execution of common command-line utilities used for network reconnaissance and discovery, such as arp, nbtstat, net, and ping. These commands are frequently used by adversaries to map network infrastructure, identify active hosts, and discover shared resources on a target network.
Detects host-enumeration activities performed by PowerShell processes, including anti-virus queries, system information gathering, network configuration checks, and file/drive enumeration, specifically when correlated with suspicious outbound network connections to common task-runner C2 infrastructure.
Detects a sequence of PowerShell commands consistent with the VelvetCake reconnaissance module, including enumeration of antivirus software via SecurityCenter2, system information, IP configurations, running processes, recent files, and drive mapping within a short timeframe.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects a cluster of host enumeration and system discovery commands (such as whoami, hostname, systeminfo, and network config queries) executed by the same process account within a short window, which is often indicative of post-exploitation reconnaissance.
Detects the presence of known artifacts associated with the SparroWocky loader and backdoor, specifically identifying the file names 'winfsp-x64.dll' and 'DukeQt.dll', or files matching known SHA1 hashes of SparroWocky samples. The presence of these files on a host is a strong indicator of compromise.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects execution of common reconnaissance and system discovery commands (e.g., whoami, netstat, ifconfig) initiated by web server or application runtime processes (e.g., httpd, nginx, tomcat, node). This behavior is highly indicative of post-exploitation activity where an adversary attempts to gather system or network information after successfully compromising a web-based service.
Detects rapid, non-interactive ransomware-like behavior characterized by system reconnaissance followed by automated bulk file deletion of model/data files (e.g., .ckpt, .pt). The rule identifies campaigns where discovery, lateral movement or automated execution, and destructive impact occur within a 3-hour window without any interactive user login evidence.
Detects instances where a process masquerading as 'firefox.exe' executes common system reconnaissance commands such as systeminfo, ipconfig, whoami, and tasklist from non-standard file paths. This behavior is indicative of the BabylonRAT malware attempting to gather system and network information after establishing persistence.
Page 4 of 16