Browse Rules

Account Discovery Command via SYSTEM Account

Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.

Pluggable Authentication Module (PAM) Version Discovery

This rule detects PAM version discovery activity on Linux systems. PAM version discovery can be an indication of an attacker attempting to backdoor the authentication process through malicious PAM modules.

PowerShell Suspicious Discovery Related Windows API Functions

Detects PowerShell scripts that references native Windows API functions commonly used for discovery of users, groups, shares, sessions, domain trusts, and service security. Attackers use these APIs for situational awareness and targeting prior to lateral movement or collection.

Deprecated - PowerShell Script with Discovery Capabilities

Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.

Discovery Command Output Written to Suspicious File

Detects when a discovery command is executed followed by the immediate modification of a suspicious file via the same process. Many types of malware execute discovery commands, save the output to a file, and then exfiltrate that file via their C2 channel.

System Information Discovery via Windows Command Shell

Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows Command Shell.

Remote System Discovery Commands

Discovery of remote system information using built-in commands, which may be used to move laterally.

Deprecated - Unusual Discovery Activity by User

This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id and user.id entries.

System Public IP Discovery via DNS Query

Identifies DNS queries to known public IP address lookup web services from suspicious Windows processes, which can reveal external IP or internet-connectivity discovery before follow-on activity.

Unusual Discovery Signal Alert with Unusual Process Executable

This rule leverages Discovery building block rule alert data to alert on signals with unusual unique host.id, user.id and process.executable entries.

System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from a compromised system.

System Time Discovery

Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system.

Potential Network Share Discovery

Adversaries may look for folders and drives shared on remote systems to identify sources of information to gather as a precursor for collection and identify potential systems of interest for Lateral Movement.

Polkit Version Discovery

This rule detects Polkit version discovery activity on Linux systems. Polkit version discovery can be an indication of an attacker attempting to exploit misconfigurations or vulnerabilities in the Polkit service.

Unusual Discovery Signal Alert with Unusual Process Command Line

This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id, user.id and process.command_line entries.

PowerShell Script with Password Policy Discovery Capabilities

Identifies PowerShell script block content that queries Active Directory password policy settings using AD cmdlets, GPP password helpers, or directory searcher attributes. Attackers collect password policy details to tune credential attacks and target weak configurations.

Account or Group Discovery via Built-In Tools

Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.

Process Discovery via Built-In Applications

Identifies the use of built-in tools attackers can use to discover running processes on an endpoint.

Security Software Discovery via Grep

Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus or Host Firewall details.

Windows Network Enumeration

Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool.

Kernel Instrumentation Discovery via kprobes and tracefs

Detects common utilities accessing kprobes and tracing-related paths in debugfs/tracefs, which may indicate discovery of kernel instrumentation hooks. Adversaries can enumerate these locations to understand or prepare for eBPF, kprobe, or tracepoint-based activity. This behavior can also be benign during troubleshooting, performance analysis, or observability tooling validation.

System Owner/User Discovery Linux

Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system.

Linux External IP Address Discovery via Curl

Detects applications making a curl request to a known public IP address lookup web service. Malware tends to perform this action to assess potential targets.

Windows Account or Group Discovery

This rule identifies the execution of commands that enumerates account or group information. Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.

Potential Kubeletctl Execution

Detects the execution of kubeletctl on Linux hosts. Kubeletctl is a command-line tool that can be used to interact with the Kubelet API directly, simplifying access to Kubelet endpoints that can be used for discovery and, in some cases, lateral movement within Kubernetes environments.