Every published rule

Linux process discovery via grep/egrep searching for security software strings

Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.

Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed

Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.

Windows Process: reg.exe Software Version Discovery via svcVersion Query

Alerts when reg.exe is used to query \Software\ for svcVersion, indicating Windows software version discovery.

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

Linux System Information Discovery via Common Command-Line Utilities

Flags Linux executions of uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod for system discovery behavior.

Linux System & Hardware Information Discovery via File and Version Reads

Detects Linux file access to BIOS/DMI, hardware model, kernel, and OS release/issue identifiers used for system profiling.

Linux Password Policy Discovery via chage and passwd Commands

Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.

macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults

Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.

Linux System Network Discovery via Firewall/Network Tools

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

Linux process discovery via common process listing and monitoring tools

Flags Linux execution of common tools used to enumerate running processes.

Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options

Alerts on SharpHound/Bloodhound-like processes launching with discovery-focused command-line parameters.

Windows System Time Discovery via net.exe or w32tm.exe

Flags Windows net.exe/net1.exe or w32tm.exe command lines used to query system time/time zone.

Windows Domain Trust Discovery Using dsquery.exe TrustedDomain Queries

Flags Windows executions of dsquery.exe with trustedDomain to discover Active Directory domain trusts.

Windows Local Account Discovery via System Utilities Process Execution

Flags Windows processes that match utilities used to enumerate local user and account information.

Linux System Owner or User Discovery via Common Utility Execution

Flags execution of Linux user/system identification utilities such as whoami and id.

Cisco AAA discovery via show/dir commands

Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.