File and Directory Discovery detection rulesT1083

Detects automated lateral movement by Turla group

windows · process_creation

Detects WannaCry ransomware activity

windows · process_creation

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

windows · process_creation

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

windows · process_creation

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

linux · process_creation

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects usage of "find" binary in a suspicious manner to perform discovery

linux · process_creation

Detects usage of "find" binary in a suspicious manner to perform discovery

macos · process_creation

Detects technique used by MAZE ransomware to enumerate directories using Powershell

windows · ps_script

Detect adversaries enumerate sensitive files

windows · ps_script

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

windows · process_creation

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

linux · process_creation

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects source code enumeration that use GET requests by keyword searches in URL strings

webserver

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

linux · process_creation

Find information about network devices that is not stored in config files

cisco

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

windows · process_creation

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

linux

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

windows · process_creation

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

linux · process_creation

Detects usage of system utilities to discover files and directories

macos · process_creation