Sigma detection rules, expert-reviewed

Windows WMIC System Information Discovery via WMI Command-Line Queries

Flags WMIC command-line queries that pull OS, hardware, disk, memory, BIOS, and GPU details while excluding VMware Tools discovery scripts.

Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

Linux ESXi esxcli VSAN Information Discovery via esxcli Command

Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.

Linux Process Execution of esxcli VM Listing Commands

Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).

Linux Process Creation: ESXi esxcli system discovery via system namespace

Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.

Linux ESXi esxcli Storage Information Discovery via esxcli storage commands

Flags Linux process executions of esxcli with storage discovery subcommands like get/list.

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Alerts when an ESXi esxcli command queries or lists network configuration via the "network" flag.

Linux Process Discovery of Container Environment via ls -i on / Directory

Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.

Linux Docker Container Discovery via .dockerenv File Listing or Reads

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif

Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.

Linux grep file discovery targeting GobRAT-specific filenames

Alerts on grep executions on Linux whose arguments contain specific malware-related file names for discovery.

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.