Every published rule

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

Windows sc.exe Service Query Execution via Process Creation

Flags sc.exe executions with command lines containing " query", consistent with Windows service information discovery.

Windows Process Command Line Containing Whoami as First Parameter

Flags Windows process creations with command lines containing '.exe whoami' to surface potential discovery behavior.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.

Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads

Triggers on auditd events showing host enumeration commands and system identity file access on Linux.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.

Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.

PowerShell executes ADRecon.ps1 AD reconnaissance functions and writes ADRecon-Report.xlsx

Detects PowerShell ADRecon reconnaissance script content by matching AD discovery functions and the default ADRecon report output name.

PowerShell Script Block Logging: PowerView cmdlet names match

Alerts when PowerShell ScriptBlockText includes PowerView/PowerSploit reconnaissance cmdlet names tied to domain and access discovery.

Windows Process Creation: Exchange Server Artifact Discovery and File Staging Patterns

Alerts on Exchange-focused suspicious Windows command-line activity involving dumping, temp file creation, and compression utilities.

macOS Remote System Discovery via arp or ping enumeration

Identifies macOS arp -a or ping to private/local IP ranges used for remote system enumeration.

Linux Remote System Discovery via arp and ping Process Execution

Flags Linux arp or ping commands with LAN/loopback/link-local IP range arguments consistent with remote host discovery.

Linux auditd: Network service enumeration via telnet, nmap, or netcat

Alerts when telnet/nmap/netcat-style binaries are executed on Linux via auditd, consistent with service discovery scanning.

macOS System Network Connection Discovery via who, w, last, lsof, or netstat

Flags macOS process executions of who/w/last/lsof/netstat used to discover network or session information.

macOS Security Software Discovery via grep of Known Security Software Names

Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.

macOS File and Directory Discovery via System Utilities

Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.

Linux System Network Connections Discovery via who, w, last, lsof, or netstat

Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.