MITRE ATT&CK technique
Process Discovery detection rulesT1057
Process Discovery (T1057) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 8 community-maintained Sigma detection rules in the library mapped to T1057 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, cisco.
HackTool - PCHunter Execution
highDetects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
windows · process_creation
Potential Process Reconnaissance via Wmic.EXE
mediumDetects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.
windows · process_creation
Recon Command Output Piped To Findstr.EXE
mediumDetects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
windows · process_creation
Cisco Discovery
lowFind information about network devices that is not stored in config files
cisco
Process Discovery
lowDetects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network
linux · process_creation
Suspicious Process Discovery With Get-Process
lowGet the processes that are running on the local computer.
windows · ps_script
System Info Discovery via Sysinfo Syscall
lowDetects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
linux
Suspicious Tasklist Discovery Command
informationalAdversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network
windows · process_creation