Sigma detection rules, expert-reviewed

Windows PowerShell AD Module DLL Import for Active Directory Enumeration

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole

Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.

macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.

Linux find Command Used to Discover SUID/SGID and World-Writable Files

Alerts on Linux usage of /find with setuid/sgid and permissive permission filters, consistent with discovery activity.

Linux Privilege Capability Discovery via getcap

Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.

Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

Windows: Detect winPEAS privilege escalation reconnaissance execution

Flags Windows executions of winPEAS/PEASS-ng based on image name and command-line discovery options and release download indicators.

Windows PowerShell Sensitive File Discovery via ScriptBlock Enumeration

PowerShell script blocks using recursive file enumeration that target sensitive file extensions.

PowerShell User Discovery and Export with Get-ADUser

Flags PowerShell Get-ADUser enumeration (filter *) followed by exporting results to a file.

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

Windows Process Creation: Renamed AdFind.exe Executions

Detects renamed AdFind.exe executions using AdFind-style domain discovery command-line indicators, OriginalFileName, and known binary hashes.

Windows: DirLister.exe Execution for Directory Listing Discovery

Alerts on execution of DirLister.exe on Windows, indicating potential directory/file discovery activity.