Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
This rule detects an unusual frequency of command-line executions containing the terms 'compliance' or 'audit' on a single computer within a one-hour window. This activity could indicate an adversary performing reconnaissance or discovery to understand system configurations, security policies, or auditing mechanisms.
Detects PowerShell queries for motherboard serial numbers or UUIDs, behaviors commonly associated with malware reconnaissance and sandbox evasion. This rule specifically looks for 'powershell.exe' executing commands that query 'Win32_BaseBoard' or 'Win32_ComputerSystemProduct' and contain 'SerialNumber' or 'UUID'.
Detects the execution of the initial fingerprinting PowerShell script utilized by the PhantomRelay RAT. PhantomRelay is a custom Remote Access Trojan associated with the Russia-nexus threat group GREYVIBE. The script gathers system information such as computer name, username, and PID, using a hardcoded User-Agent string before connecting to the C2 server.
This rule detects an unusual frequency of command-line executions containing the terms 'compliance' or 'audit' on a single computer within a one-hour window. This activity could indicate an adversary performing reconnaissance or discovery to understand system configurations, security policies, or auditing mechanisms.
This rule detects HTTP requests containing 'phpinfo' in the URI, which is commonly used for system information reconnaissance. This activity is associated with MITRE ATT&CK technique T1082 (System Information Discovery).
Detects attempts by the Grixba ransomware to query a specific custom locale registry key (en-US) for geofencing purposes. This activity is indicative of the ransomware checking the system's locale settings, potentially to avoid encrypting systems in certain geographical regions.
This rule detects an unusual frequency of inventory-related commands being executed on a device within a one-hour window. Specifically, it looks for `tasklist.exe`, `wmic.exe`, or `Get-HotFix` being run 5 or more times in an hour. This behavior can indicate an adversary performing system information discovery.
This rule detects a multi-stage attack chain associated with the Nimbus RAT, starting with a suspicious Microsoft Teams message (vishing) from an external sender using throwaway domains (e.g., .onmicrosoft.com, .top). This initial communication is then correlated with subsequent reconnaissance activities performed via Quick Assist, where QuickAssist.exe spawns cmd.exe to execute commands like 'net time', '/domain', 'whoami', 'ipconfig', or 'systeminfo' on the victim's device within a two-hour window. The rule aims to identify the internal victim and the external sender involved in this coordinated attack.
Detects wscript.exe executing WMI queries targeting specific Win32 classes (such as Win32_SystemEnclosure, Win32_VideoController, etc.) to profile the host system. This behavior is associated with JS.MonoGlyphRAT, which extensively profiles systems before deploying secondary payloads.
Detects Quick Assist spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe) that execute common discovery and reconnaissance commands. This pattern is associated with hands-on-keyboard activity, as documented in campaigns like Nimbus RAT, and broader kill chains used by groups such as Storm-1811, Black Basta affiliates, and 3AM ransomware operators. The rule specifically looks for commands like 'whoami', 'ipconfig', 'systeminfo', 'hostname', 'net time', 'net user', 'net group', 'net localgroup', 'net view', 'nltest', 'qwinsta', 'tasklist', 'arp', 'route', 'netstat', '/domain', 'dsquery', and 'gpresult'.
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
Detects wscript.exe querying multiple Win32 WMI classes within a short timeframe to gather host telemetry. This behavior aligns with JS.MonoGlyphRAT's pre-payload execution profiling.
Identifies QuickAssist.exe launching cmd.exe to perform network and domain discovery commands. This behavior is indicative of post-exploitation reconnaissance following a remote support session, commonly seen in Nimbus RAT campaigns.
Detects the execution of specific function names commonly associated with the WinPEAS PowerShell enumeration script, often used by adversaries to find privilege escalation paths.
Detects PowerShell script blocks containing WMI queries (Get-WmiObject or SELECT statements) targeting specific Win32 classes commonly used for system reconnaissance.
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
This rule detects attempts to extract the system's hardware UUID using the `ioreg` command, specifically looking for arguments used by the FlutterShell backdoor to query `IOPlatformExpertDevice` and `IOPlatformUUID`. This activity is indicative of system information discovery, often performed by malware to fingerprint a compromised host.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects PowerShell commands attempting to query the Terminal Services Remote Connection Manager event log for Event ID 1149. This may indicate adversary reconnaissance of RDP connection history to identify targets for lateral movement.
Detects discovery commands checking for the presence of the vulnerable 'algif_aead' kernel module. Checking if this module is loaded is a prerequisite step for both defenders mitigating the threat and attackers profiling targets for CVE-2026-31431 (CopyFail).
This rule detects the execution of specific Linux utilities that can be used to gather system information, related to virtualization and hardware details. Adversaries often use these tools during the discovery phase to understand the environment they have compromised and adjust accordingly.
Page 28 of 39