Every published rule

Linux Docker Container Discovery via .dockerenv File Listing or Reads

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif

Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.

Linux grep file discovery targeting GobRAT-specific filenames

Alerts on grep executions on Linux whose arguments contain specific malware-related file names for discovery.

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.

Windows: Detect csvde.exe Active Directory export to CSV

Flags csvde.exe executions on Windows that include -f, consistent with exporting Active Directory data for discovery.

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.

Windows nltest.exe Execution for Network Information Discovery

Flags execution of nltest.exe (including nltestrk.exe via OriginalFileName) used for network and domain information discovery.

Windows WMIC System Information Discovery via WMIC.EXE Recon

Flags WMIC.EXE executions running system info queries for OS and disk details.

Windows PowerShell AD Module DLL Import for Active Directory Enumeration

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole

Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.

macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.

Linux find Command Used to Discover SUID/SGID and World-Writable Files

Alerts on Linux usage of /find with setuid/sgid and permissive permission filters, consistent with discovery activity.

Linux Privilege Capability Discovery via getcap

Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.

Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.