Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
16
3
3
3
2
Contributors
10
6
4
3
2
Categories
15
12
3
2
2
Platforms
20
5
2
1
Products / Services
6
4
4
3
2
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
2
1
IDS Protocols
1
1
1
This rule detects various commands and file accesses indicative of system information discovery on Linux systems using auditd logs. It looks for access to common system release files like /etc/lsb-release, /etc/redhat-release, and /etc/issue. Additionally, it identifies the execution of commands such as 'uname', 'uptime', 'lsmod', 'hostname', and 'env'. The rule also flags 'grep' commands searching for virtualization indicators ('vbox', 'vm', 'xen', 'virtio', 'hv') and 'kmod list' commands, which are often used to enumerate loaded kernel modules.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
This rule identifies the use of `net.exe`, `net1.exe`, or `w32tm.exe` commands to query system time or time zone information. Adversaries may use these commands to gather information about a target system's time settings, potentially before executing scheduled tasks or to understand the system's geographical context.
This rule detects the use of 'w32tm.exe' with specific command-line arguments that allow it to act as a delay mechanism. Adversaries may leverage this legitimate Windows utility to introduce delays in their execution, potentially for sandbox evasion or to time their activities. The detected command-line arguments include '/stripchart', '/computer:', '/period:', '/dataonly', and '/samples:'.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Page 2 of 2