Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
332 detections
Filters
Last updated
All Time
Detection languages
121
113
37
21
15
Contributors
58
49
41
33
23
Categories
241
229
38
28
19
Platforms
280
52
10
7
4
Products / Services
86
68
67
27
25
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.
This rule detects suspicious command-line activity originating from common web server processes, indicative of web shell usage for reconnaissance and system interaction. It looks for specific utilities and command-line arguments often used by attackers to discover system information, user accounts, network configurations, and execute arbitrary commands through a compromised web server.
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects the execution of 'whoami.exe' when its parent process is not a common legitimate shell or application, or when the parent process information is missing. This can indicate suspicious activity, as 'whoami.exe' is often used by attackers for discovery purposes.
Detects the execution of whoami.exe with suspicious parent processes.
Detects the execution of "whoami.exe" with the "/FO CSV" flag to choose CSV as output format or with redirection options (e.g., `whoami > file.txt`) to export the results to a file for later use. This activity is often observed in post-exploitation discovery phases by adversaries to gather information about the current user.
Detects the execution of the 'whoami.exe' command by highly privileged accounts such as 'AUTHORITY\SYSTEM', 'NT AUTHORITY\SYSTEM', or 'TrustedInstaller'. This activity can indicate an attacker performing discovery after achieving privilege escalation, as these accounts are often targeted for abuse.
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
Detects PowerShell execution that enumerates Active Directory users with the 'DONT_REQ_PREAUTH' flag set (UserAccountControl flag 4194304). This flag indicates that the account does not require Kerberos pre-authentication, making it vulnerable to AS-REP Roasting attacks where an attacker can request a Ticket Granting Ticket (TGT) without providing credentials and then attempt to crack the hash offline.
Detects patterns indicative of the exploitation of the Serv-U CVE-2021-35211 vulnerability, specifically looking for the execution of 'whoami' in conjunction with specific file paths related to the Serv-U client. This activity has been associated with the threat group DEV-0322.
Detects the execution of SharpLdapWhoami, a tool designed to query LDAP services on a domain controller to identify the current user, similar to the 'whoami' command. The rule looks for the executable name, original filename, product name, and specific command-line arguments related to authentication methods.
Detects a suspicious process command line where 'whoami' is used as the first parameter, which can be indicative of privilege escalation techniques like those used by EfsPotato. This rule specifically looks for '.exe whoami' in the command line.
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. This activity is often seen in reconnaissance phases where attackers map out the network environment.
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Page 15 of 16