Browse Rules

Search and filter across all detection sources

582 rules

sentinel low kql

GCP IAM - Privileges Enumeration

'Detects possible privileges enumeration.'

sigma low sigma

Kubernetes Secrets Enumeration

Detects enumeration of Kubernetes secrets.
hayabusa medium sigma

Password Policy Enumerated

Detects when the password policy is enumerated.
sagan medium other

[EXTRAHOP] BloodHound Enumeration Activity

[EXTRAHOP] BloodHound Enumeration Activity
sagan medium other

[EXTRAHOP] Domain Controller Enumeration

[EXTRAHOP] Domain Controller Enumeration
sagan medium other

[EXTRAHOP] Domain Trusts Enumeration

[EXTRAHOP] Domain Trusts Enumeration
sagan medium other

[EXTRAHOP] Domain Workstation Enumeration

[EXTRAHOP] Domain Workstation Enumeration
sagan medium other

[EXTRAHOP] Domain Workstation Enumeration

[EXTRAHOP] Domain Workstation Enumeration
sagan medium other

[EXTRAHOP] Kerberos User Enumeration

[EXTRAHOP] Kerberos User Enumeration
sagan medium other

[EXTRAHOP] Local User Enumeration

[EXTRAHOP] Local User Enumeration
sagan medium other

[EXTRAHOP] SMB Share Enumeration

[EXTRAHOP] SMB Share Enumeration
sentinel low kql

GCP IAM - Service Account Enumeration

'Detects possible service account enumeration.'

sigma medium sigma

Password Policy Enumerated

Detects when the password policy is enumerated.
hayabusa low sigma

Fsutil Drive Enumeration

Attackers may leverage fsutil to enumerated connected drives.
sigma low sigma

Fsutil Drive Enumeration

Attackers may leverage fsutil to enumerated connected drives.
hayabusa low sigma

Fsutil Drive Enumeration

Attackers may leverage fsutil to enumerated connected drives.
mdecrevoisier medium sigma

Scheduled task enumerated

Detects scenarios where an attacker enumerates scheduled task configuration.
sagan medium other

[EXTRAHOP] Alias Member Enumeration Attempt

[EXTRAHOP] Alias Member Enumeration Attempt
sagan medium other

[EXTRAHOP] AWS Cloud Service Enumeration

[EXTRAHOP] AWS Cloud Service Enumeration
sagan medium other

[EXTRAHOP] Group Member Enumeration Attempt

[EXTRAHOP] Group Member Enumeration Attempt
sagan medium other

[EXTRAHOP] Invoke-ShareFinder Enumeration Attempt

[EXTRAHOP] Invoke-ShareFinder Enumeration Attempt
sagan medium other

[EXTRAHOP] Logged-On User Enumeration

[EXTRAHOP] Logged-On User Enumeration
sagan medium other

[EXTRAHOP] New WMI Enumeration Query

[EXTRAHOP] New WMI Enumeration Query
sagan medium other

[EXTRAHOP] RDP Session Enumeration Attempt

[EXTRAHOP] RDP Session Enumeration Attempt
sagan critical other

[WINDOWS-SECURITY] Possible Enumeration - dnscmd

[WINDOWS-SECURITY] Possible Enumeration - dnscmd