Sigma detection rules, expert-reviewed

Linux Process Creation: ESXi esxcli system discovery via system namespace

Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.

Linux ESXi esxcli Storage Information Discovery via esxcli storage commands

Flags Linux process executions of esxcli with storage discovery subcommands like get/list.

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Alerts when an ESXi esxcli command queries or lists network configuration via the "network" flag.

Linux Process Discovery of Container Environment via ls -i on / Directory

Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.

Linux Docker Container Discovery via .dockerenv File Listing or Reads

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif

Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.

Linux grep file discovery targeting GobRAT-specific filenames

Alerts on grep executions on Linux whose arguments contain specific malware-related file names for discovery.

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.

Windows: Detect csvde.exe Active Directory export to CSV

Flags csvde.exe executions on Windows that include -f, consistent with exporting Active Directory data for discovery.

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.

Windows nltest.exe Execution for Network Information Discovery

Flags execution of nltest.exe (including nltestrk.exe via OriginalFileName) used for network and domain information discovery.

Windows WMIC System Information Discovery via WMIC.EXE Recon

Flags WMIC.EXE executions running system info queries for OS and disk details.