Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
59
31
19
2
2
Contributors
20
16
12
11
10
Categories
57
54
14
14
11
Platforms
94
34
26
4
2
Products / Services
28
27
13
6
6
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
3
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects various commands and processes used by adversaries to enumerate virtual machine software, hypervisor configurations, and virtualization-based security features on a host. This is often part of reconnaissance to understand the environment, detect sandboxing, or identify virtualization platforms for further post-exploitation activities.
Detects enumeration of installed software via WMI or registry
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
This rule detects various commands and processes used by adversaries to enumerate virtual machine software, hypervisor configurations, and virtualization-based security features on a host. This is often part of reconnaissance to understand the environment, detect sandboxing, or identify virtualization platforms for further post-exploitation activities.
Detects reconnaissance activities aimed at identifying c-ares library linkage using tools like ldd, readelf, and strings, or via pattern matching in files. It also monitors for the suspicious loading of cares.dll outside of expected vendor directories and the execution of specific files identified as part of a c-ares TCP use-after-free proof-of-concept.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects a hidden PowerShell instance collecting hostname, user, domain, operating system, architecture, and security-product information. This behavior is indicative of reconnaissance activities often performed by malware like InstallFix.
Security Driver and Service Enumeration
Cortex XDR
This rule detects attempts to enumerate security-related drivers and services, specifically targeting ESET, Npcap, NPF, and Sysmon components. It looks for command-line utilities like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' being used with specific driver/service names. The XQL view includes actor and causality fields for investigation.
This YARA rule detects the presence of specific strings associated with security drivers and system monitoring tools (ESET, Npcap, Sysmon) within a file or memory. The detection of these strings, particularly in a cluster, suggests an environment reconnaissance activity, potentially by malware like Sessiongate, which might be checking for the presence of security software or network capture tools.
This rule detects attempts to query software inventory using 'wmic product' via a web shell. It specifically looks for HTTP requests where the URI contains the string 'wmic product', indicating a potential command execution to enumerate installed software on a compromised system.
This rule detects attempts to enumerate installed software on a Windows machine via Remote WMI (Windows Management Instrumentation) over SMB (Server Message Block) on port 445. Specifically, it looks for the string "Win32_Product" within TCP traffic destined for port 445, indicating a WMI query for installed products. A threshold of 5 occurrences within 30 seconds from the same source is set to reduce false positives.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects suspicious post-exploitation activity originating from the BeyondTrust/Bomgar session process, `bomgar-scc.exe`. It identifies the execution of common Windows command-line interpreters and scripting environments (`cmd.exe`, `powershell.exe`, `pwsh.exe`, etc.) or the presence of specific command-line substrings indicative of privilege escalation, credential access, reconnaissance, lateral movement, defense evasion (like log clearing), or download/execution cradles. The rule assigns a risk score based on the detected activities and triggers an alert if the cumulative score and unique child process count exceed predefined thresholds, suggesting a high-confidence post-exploitation scenario.
KQL Query from file: VSCode Extension Inventory In Your MDE Tenant
Detects execution of ToastNotify.exe with the getaumid subcommand, which enumerates registered Application User Model IDs from the HKCU and HKLM notification settings registry hives. This is the reconnaissance phase of a toast notification phishing attack, used to identify trusted AUMIDs to impersonate.
Detects PowerShell enumerating Application User Model IDs via the notification settings registry hive, the Get-StartApps cmdlet, or the System.AppUserModel.ID extended property on .lnk shortcuts. Attackers use these to discover trusted AUMIDs to impersonate in fake toast notifications.
This rule identifies devices running vulnerable versions of Notepad++. It parses the software version to determine if it is older than 8.9.1, which was identified as vulnerable in a security incident. The rule specifically looks for Notepad++ installations and flags any instances where the major version is less than 8, or if the major version is 8 and the minor version is less than 9, or if the major version is 8, the minor version is 9, and the patch version is less than 1.
This query identifies potential post-exploitation behavior on Linux systems by monitoring for clusters of discovery and enumeration commands. Instead of alerting on single, potentially benign commands, it utilizes a behavioral scoring engine that categorizes activities such as credential hunting, privilege escalation, and network scanning.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
Page 4 of 6