Sigma detection rules, expert-reviewed

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

This rule detects the SimpleHelp Remote Access client spawning a command shell that runs account and domain enumeration utilities. Following exploitation of SimpleHelp RMM for initial access, operators used the persisted client to run net and nltest reconnaissance.

Suspicious Domain Trust Discovery via Nltest

This rule detects the nltest utility enumerating domain trusts, a reconnaissance step performed after GoldMelody gained code execution through ASP.NET ViewState deserialization. Adversaries map domain trust relationships to plan lateral movement. While administrators occasionally use nltest, its execution from web-facing hosts is suspicious.

Windows Registry Query for System Language Using reg.exe

Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows: Notepad Password File Discovery via Process Creation

Flags explorer-launched Notepad opening files named like password*.{txt,csv,doc,xls} that may contain credentials.

MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)

Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.

Windows WMI Disk and Volume Discovery via WMIC.exe

Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.

Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries

Alerts on unexpected process-to-ADWS (TCP/9389) connections on Windows to highlight potential directory discovery.

macOS Process Execution of system_profiler for System Discovery via Specific Data Types

Flags macOS system_profiler runs that request application, hardware, network, and USB data via command-line data types.

macOS System Information Discovery via sw_vers with product/build flags

Detects sw_vers executions on macOS that request product name/version or build version details.

macOS Process Discovery via ioreg I/O Kit Registry Queries

Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.