Sigma detection rules, expert-reviewed

Windows: Detect csvde.exe Active Directory export to CSV

Flags csvde.exe executions on Windows that include -f, consistent with exporting Active Directory data for discovery.

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.

Windows nltest.exe Execution for Network Information Discovery

Flags execution of nltest.exe (including nltestrk.exe via OriginalFileName) used for network and domain information discovery.

Windows WMIC System Information Discovery via WMIC.EXE Recon

Flags WMIC.EXE executions running system info queries for OS and disk details.

Windows PowerShell AD Module DLL Import for Active Directory Enumeration

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole

Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.

macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery

Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.

Linux find Command Used to Discover SUID/SGID and World-Writable Files

Alerts on Linux usage of /find with setuid/sgid and permissive permission filters, consistent with discovery activity.

Linux Privilege Capability Discovery via getcap

Flags Linux executions of /getcap with -r to recursively enumerate file capabilities during discovery.

Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

Windows: Detect winPEAS privilege escalation reconnaissance execution

Flags Windows executions of winPEAS/PEASS-ng based on image name and command-line discovery options and release download indicators.

Windows PowerShell Sensitive File Discovery via Script Block Enumeration

PowerShell script blocks using recursive file enumeration that target sensitive file extensions.