Windows: DirLister.exe Execution for Directory Listing Discovery
Alerts on execution of DirLister.exe on Windows, indicating potential directory/file discovery activity.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-08-20
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executed file is DirLister.exe, including cases where the image path ends with \DirLister.exe. Attackers may use this utility to quickly enumerate accessible directories and files as part of discovery before follow-on actions. It relies on Windows process creation telemetry that includes the original file name and the executable image path.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md
- news.sophos.comhttps://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dirlister_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: DirLister.exe Execution for Directory Listing Discovery"
id: 96ae91e7-4fe2-4b5e-9f54-b6bf9bf5e05b
status: test
description: This rule flags process creation events where the executed file is DirLister.exe, including cases where the image path ends with \DirLister.exe. Attackers may use this utility to quickly enumerate accessible directories and files as part of discovery before follow-on actions. It relies on Windows process creation telemetry that includes the original file name and the executable image path.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1083/T1083.md
- https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dirlister_execution.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-02-04
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: windows
detection:
selection:
- OriginalFileName: DirLister.exe
- Image|endswith: \DirLister.exe
condition: selection
falsepositives:
- Legitimate use by users
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dirlister_execution/info.yml
simulation:
- type: atomic-red-team
name: Launch DirLister Executable
technique: T1083
atomic_guid: c5bec457-43c9-4a18-9a24-fe151d8971b7
license: DRL-1.1
related:
- id: b4dc61f5-6cce-468e-a608-b48b469feaa2
type: derived