Sigma detection rules, expert-reviewed

Windows Net.exe Network Connections Discovery via Use Sessions Query

Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Alerts when SharpView.exe runs with command-line indicators of AD and network discovery/enumeration activity.

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

Windows sc.exe Service Query Execution via Process Creation

Flags sc.exe executions with command lines containing " query", consistent with Windows service information discovery.

Windows Process Command Line Containing Whoami as First Parameter

Flags Windows process creations with command lines containing '.exe whoami' to surface potential discovery behavior.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.

Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads

Triggers on auditd events showing host enumeration commands and system identity file access on Linux.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

Flags Windows commands combining recursive dir listing, FINDSTR usage, and document-type targeting in one execution.

Windows nltest.exe Recon via Server Query and Domain Trust Enumeration

Alerts on nltest.exe commands with server/query and domain trust enumeration arguments often used for Windows discovery.

PowerShell executes ADRecon.ps1 AD reconnaissance functions and writes ADRecon-Report.xlsx

Detects PowerShell ADRecon reconnaissance script content by matching AD discovery functions and the default ADRecon report output name.