Every published rule

Windows Registry Query for System Language Using reg.exe

Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)

Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.

Windows WMI Disk and Volume Discovery via WMIC.exe

Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.

Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries

Alerts on unexpected process-to-ADWS (TCP/9389) connections on Windows to highlight potential directory discovery.

macOS Process Execution of system_profiler for System Discovery via Specific Data Types

Flags macOS system_profiler runs that request application, hardware, network, and USB data via command-line data types.

macOS System Information Discovery via sw_vers with product/build flags

Detects sw_vers executions on macOS that request product name/version or build version details.

macOS Process Discovery via ioreg I/O Kit Registry Queries

Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.

Windows WMIC System Information Discovery via WMI Command-Line Queries

Flags WMIC command-line queries that pull OS, hardware, disk, memory, BIOS, and GPU details while excluding VMware Tools discovery scripts.

Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

Linux ESXi esxcli VSAN Information Discovery via esxcli Command

Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.

Linux Process Execution of esxcli VM Listing Commands

Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).

Linux Process Creation: ESXi esxcli system discovery via system namespace

Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.

Linux ESXi esxcli Storage Information Discovery via esxcli storage commands

Flags Linux process executions of esxcli with storage discovery subcommands like get/list.

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Alerts when an ESXi esxcli command queries or lists network configuration via the "network" flag.

Linux Process Discovery of Container Environment via ls -i on / Directory

Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.