Sigma detection rules, expert-reviewed

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

This rule detects a command line that changes the console code page with chcp and then runs nltest for domain trust enumeration. TA866 Asylum Ambuscade used cmd.exe with chcp 65001 chained to nltest DOMAIN_TRUSTS during host reconnaissance. A UTF-8 code-page switch immediately preceding domain trust enumeration is a scripted discovery pattern tied to this actor.

Suspicious Domain Trust Discovery Via Nltest

This rule detects nltest.exe enumerating domain trust relationships. UAT-5647 ran nltest domain_trusts to map Active Directory trusts during reconnaissance in the RomCom intrusions. Nltest domain trust enumeration is a common domain-discovery action attackers use to plan lateral movement across trusted domains.

Antivirus Software Discovery via tasklist and findstr

This rule detects reconnaissance that pipes tasklist output through findstr to enumerate running security product processes. CastleLoader performs this check to identify installed defenses before deploying its payload.

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

This rule detects quser or qwinsta enumerating interactive logon sessions, a system-owner and remote-session discovery step attackers use to find active administrators before lateral movement. Session discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces reconnaissance of who is logged on.

Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)

This rule detects command lines that enumerate installed antivirus or EDR products through the SecurityCenter2 WMI namespace or Get-MpComputerStatus, a security-software-discovery step taken to plan defense evasion. Security software discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces an attacker profiling defenses before acting.

Suspicious Group Discovery - Command (via process_creation)

This rule detects enumerate local or domain groups via commandline.

Malicious Network Share Discovery And/or Connection via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

This rule detects WMIC queries against keyboard, pointing device and monitor WMI classes used by the SHUYAL stealer to fingerprint the host and detect analysis environments before stealing credentials. Adversaries enumerate attached hardware to build a victim profile and to evade sandboxes that lack real peripherals.

Suspicious Group Discovery - PowerShell (via powershell)

This rule detects enumerate local or domain groups via PowerShell.

Suspicious Discovery Command Spawned by Java Process

This rule detects the Cleo Java runtime spawning Windows discovery utilities such as nltest, whoami, and ipconfig, the hands-on-keyboard reconnaissance seen after exploitation of Cleo file transfer software and the Malichus malware. A Java service process launching domain and host enumeration is not part of normal operation. This lineage indicates active post-exploitation of an internet-facing Cleo server.

Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)

This rule detects PowerShell querying the root/SecurityCenter2 AntivirusProduct WMI class, the security-software discovery step Troll Stealer runs while profiling a victim before credential theft. Adversaries enumerate installed antivirus to tailor evasion, so this query outside of administrative inventory tooling is a meaningful reconnaissance indicator.

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

This rule detects discover active RDP services via tools like Hydra. Note that this event doesn't provide any information about login outcome (success or failure) as well as user information. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) as well as ID 1149 should be used.

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

This rule detects curl invocations that query the public IP lookup service ifconfig.me. MuddyWater used this command to determine the victim host external address for situational awareness prior to establishing tunnels, and while such lookups occur in some admin scripts they are unusual on endpoints and warrant review alongside other reconnaissance.

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

This rule detects enabling of the Network Discovery firewall rule group via PowerShell, the step The Gentlemen ransomware took to widen host visibility for lateral movement. Programmatically enabling network discovery firewall rules during an intrusion facilitates spread across the environment.

Suspicious SoftPerfect Network Scanner Execution for Discovery

This rule detects execution of the SoftPerfect Network Scanner netscan.exe used for internal network discovery. The Christmas Miracle actor ran this tool to map reachable hosts and services before lateral movement. Unsanctioned network scanning is a common precursor to broader compromise.