Sigma detection rules, expert-reviewed

PowerShell User Discovery and Export with Get-ADUser

Flags PowerShell Get-ADUser enumeration (filter *) followed by exporting results to a file.

Windows WMIC System Reconnaissance Using "computersystem" Flag

Flags wmic.exe runs that include the "computersystem" argument for Windows host information discovery.

Windows Process Creation: Renamed AdFind.exe Executions

Detects renamed AdFind.exe executions using AdFind-style domain discovery command-line indicators, OriginalFileName, and known binary hashes.

Windows: DirLister.exe Execution for Directory Listing Discovery

Alerts on execution of DirLister.exe on Windows, indicating potential directory/file discovery activity.

Windows DNS Query for _ldap.* Using LDAP-Related Discovery

Alerts on _ldap.* DNS queries from uncommon Windows processes, indicating potential LDAP/DNS service discovery.

Windows Command-Line Tools Performing Web POST Exfiltration via IWR/curl/wget

Identifies PowerShell/curl/wget commands on Windows that use POST-style web requests combined with data-dumping or discovery payloads.

Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns

Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.

Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution

Alerts on execution of Sysinternals PsService (PsService*.exe) on Windows, which can support service discovery and tampering.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

Windows Process Creation: gpresult.exe Group Policy (RSoP) Discovery (/z /v)

Flags process executions of gpresult.exe that request RSoP details using /z and /v on Windows.

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows PowerShell: Suspicious Process Discovery Using Get-Process

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

Windows CHCP Console Code Page Lookup Triggered From cmd.exe

Flags cmd.exe-launched chcp.com executions likely used to query system code page/locale for discovery.