| splunk |
System Information Discovery Detection |
production |
2026-10-09 |
| elastic |
Pluggable Authentication Module (PAM) Version Discovery |
production |
2026-10-09 |
| elastic |
Suspicious Kernel Feature Activity |
production |
2026-10-09 |
| elastic |
Suspicious React Server Child Process |
production |
2026-10-09 |
| splunk |
Linux Kernel Module Enumeration |
production |
2026-10-09 |
| elastic |
Virtual Machine Fingerprinting |
production |
2026-10-09 |
| elastic |
Polkit Version Discovery |
production |
2026-10-09 |
| elastic |
Privilege Boundary Enumeration Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
System Information Discovery via dmidecode from Parent Shell |
production |
2026-10-08 |
| splunk |
Windows Wmic Systeminfo Discovery |
production |
2026-10-02 |
| elastic |
ESXi System and Account Enumeration |
production |
2026-09-30 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Suspicious MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Enumeration Command Spawned via WMIPrvSE |
production |
2026-09-18 |
| elastic |
Wireless Credential Dumping using Netsh Command |
production |
2026-09-18 |
| elastic |
Azure WireServer HTTP Request from Unexpected User Agent |
production |
2026-09-18 |
| elastic |
Unusual Linux System Information Discovery Activity |
production |
2026-09-18 |
| elastic |
System and Network Configuration Check |
production |
2026-09-18 |
| elastic |
Suspicious SIP Check by macOS Application |
production |
2026-09-18 |
| elastic |
Discovery Command Output Written to Suspicious File |
production |
2026-09-18 |
| elastic |
Suspicious System Commands Executed by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Potential Meterpreter Reverse Shell |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Yum/DNF Plugin Status Discovery |
production |
2026-09-18 |
| elastic |
Suspicious which Enumeration |
production |
2026-09-18 |
| elastic |
Passwordless Sudo Probing |
production |
2026-09-18 |
| elastic |
Manual Mount Discovery via /etc/exports or /etc/fstab |
production |
2026-09-18 |
| elastic |
Hping Process Activity |
production |
2026-09-18 |
| elastic |
Kernel Unpacking Activity |
production |
2026-09-18 |
| elastic |
Kernel Seeking Activity |
production |
2026-09-18 |
| elastic |
Unusual Kernel Module Enumeration |
production |
2026-09-18 |
| elastic |
Kernel Instrumentation Discovery via kprobes and tracefs |
production |
2026-09-18 |
| elastic |
Service Account Namespace Read Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Environment Variable Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Virtual Machine Fingerprinting via Grep |
production |
2026-09-18 |
| elastic |
Azure WireServer Unusual Process Connection |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Command Line Execution |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Request |
production |
2026-09-18 |
| snort |
ET INFO GET to ip .ipify .org via WinHTTP |
rev 1 |
2026-09-11 |
| suricata |
ET HUNTING GET to ip .ipify .org via WinHTTP |
rev 1 |
2026-09-11 |
| splunk |
Cisco IOS XE Reconnaissance Command Activity |
production |
2026-05-20 |
| splunk |
Windows Wmic DiskDrive Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Memory Chip Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Network Discovery |
production |
2026-05-13 |
| splunk |
Detect attackers scanning for vulnerable JBoss servers |
experimental |
2026-05-13 |
| splunk |
Windows PsTools Recon Usage |
production |
2026-05-13 |
| splunk |
Windows WinPEAS PowerShell Script Execution |
production |
2026-05-13 |
| splunk |
Windows Wmic CPU Discovery |
production |
2026-05-13 |
| splunk |
Cisco ASA - Reconnaissance Command Activity |
production |
2026-05-13 |
| splunk |
ESXi System Information Discovery |
production |
2026-05-13 |
| splunk |
Linux Auditd Kernel Module Enumeration |
production |
2026-05-13 |
| splunk |
Web Servers Executing Suspicious Processes |
experimental |
2026-05-13 |
| splunk |
Windows Information Discovery Fsutil |
production |
2026-05-13 |
| splunk |
Windows Post Exploitation Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows PowerShell Invoke-RestMethod IP Information Collection |
production |
2026-05-13 |
| snort |
ET TROJAN MakinoLoader Systeminfo Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| suricata |
ET MALWARE MakinoLoader EDR Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| suricata |
ET MALWARE MakinoLoader Systeminfo Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader EDR Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| elastic |
Deprecated - Potential Pspy Process Monitoring Detected |
deprecated |
2026-02-04 |
| suricata |
ET INFO Commvault Server Hostname Observed in HTTP Response |
rev 3 |
2026-01-20 |
| snort |
ET INFO Commvault Server Hostname Observed in HTTP Response |
rev 3 |
2026-01-20 |
| sigma |
System Info Discovery via Sysinfo Syscall |
experimental |
2025-12-05 |
| snort |
ET WEB_SPECIFIC_APPS N-able N-central Session ID Disclosure |
rev 1 |
2025-11-25 |
| suricata |
ET WEB_SPECIFIC_APPS N-able N-central Session ID Disclosure |
rev 1 |
2025-11-25 |
| sigma |
Potential Container Discovery Via Inodes Listing |
test |
2025-11-24 |
| sigma |
System Information Discovery via Registry Queries |
experimental |
2025-10-25 |
| sigma |
System Disk And Volume Reconnaissance Via Wmic.EXE |
test |
2025-10-20 |
| snort |
ET WEB_SPECIFIC_APPS Fortra GoAnywhere MFT Response Valid License Request Token Disclosure |
rev 1 |
2025-09-25 |
| suricata |
ET WEB_SPECIFIC_APPS Fortra GoAnywhere MFT Response Valid License Request Token Disclosure |
rev 1 |
2025-09-25 |
| snort |
ET WEB_SPECIFIC_APPS VTENext Session Cookie Information Disclosure via Touch Module |
rev 1 |
2025-08-26 |
| suricata |
ET WEB_SPECIFIC_APPS VTENext Session Cookie Information Disclosure via Touch Module |
rev 1 |
2025-08-26 |
| sigma |
Potential Product Class Reconnaissance Via Wmic.EXE |
test |
2025-03-17 |
| suricata |
ET INFO Plaintext SSH Private Key Outbound over HTTP |
rev 2 |
2025-02-10 |
| snort |
ET POLICY Plaintext SSH Private Key Outbound over HTTP |
rev 1 |
2025-02-05 |
| sigma |
PUA - System Informer Execution |
test |
2024-11-23 |
| sigma |
HackTool - PCHunter Execution |
test |
2024-11-23 |
| sigma |
System Information Discovery Via Sysctl - MacOS |
test |
2024-05-27 |
| suricata |
ET WEB_SPECIFIC_APPS Jenkins Information Disclosure CVE-2017-1000395 |
rev 7 |
2024-05-01 |
| suricata |
ET EXPLOIT Quanta LTE Router Information Disclosure Exploit Attempt |
rev 5 |
2024-04-13 |
| suricata |
ET WEB_SERVER Successful DD-WRT Information Disclosure |
rev 7 |
2024-04-09 |
| sigma |
CMD Shell Output Redirect |
test |
2024-03-19 |
| suricata |
ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2 |
rev 4 |
2024-03-14 |
| suricata |
ET EXPLOIT_KIT Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M1 Dec 06 |
rev 4 |
2024-03-14 |
| suricata |
ET EXPLOIT_KIT Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M2 Dec 06 |
rev 4 |
2024-03-14 |
| sigma |
Bitbucket User Details Export Attempt Detected |
test |
2024-02-25 |
| sigma |
Bitbucket User Permissions Export Attempt |
test |
2024-02-25 |
| sigma |
System Information Discovery Via Wmic.EXE |
test |
2024-01-15 |
| sigma |
System Information Discovery Using System_Profiler |
test |
2024-01-02 |
| sigma |
System Information Discovery Using Ioreg |
test |
2024-01-02 |
| sigma |
System Information Discovery Using sw_vers |
test |
2023-12-20 |
| sigma |
Uncommon System Information Discovery Via Wmic.EXE |
test |
2023-12-19 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ICMP Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IGMP Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ARP Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - Interface Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Browse Chasis |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Chassis Detail Request |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Crashdump Display |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - System List |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - TCP Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - UDP Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation System Data Details Information Disclosure Attempt |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Routing Data |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Memory Statistics |
rev 1 |
2023-10-18 |
| snort |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Heap Memory Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Crashdump Display |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Chassis Detail Request |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - Browse Chasis |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Information Disclosure Attempt - System List |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - Interface Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ARP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IGMP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - ICMP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Heap Memory Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - General Memory Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - IP Routing Data |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation System Data Details Information Disclosure Attempt |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - UDP Statistics |
rev 1 |
2023-10-18 |
| suricata |
ET SCADA [nsacyber/ELITEWOLF] Allen-Bradley/Rockwell Automation Advanced Diagnostics Information Disclosure Attempt - TCP Statistics |
rev 1 |
2023-10-18 |
| sigma |
Docker Container Discovery Via Dockerenv Listing |
test |
2023-08-23 |
| sigma |
Container Residence Discovery Via Proc Virtual FS |
test |
2023-08-23 |
| suricata |
ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646 |
rev 1 |
2023-08-02 |
| snort |
ET WEB_SPECIFIC_APPS Metabase Setup-Token Information Disclosure - Required for CVE-2023-38646 |
rev 1 |
2023-08-02 |
| sigma |
Potential GobRAT File Discovery Via Grep |
test |
2023-06-02 |
| sigma |
OS Architecture Discovery Via Grep |
test |
2023-06-02 |
| sigma |
HackTool - winPEAS Execution |
test |
2023-03-23 |
| sigma |
System Information Discovery - Auditd |
test |
2023-03-06 |
| sigma |
Cisco Discovery |
test |
2023-01-04 |
| sigma |
Potential Suspicious Activity Using SeCEdit |
test |
2022-12-30 |
| sigma |
System and Hardware Information Discovery |
stable |
2022-11-26 |
| sigma |
Suspicious Execution of Systeminfo |
test |
2022-07-14 |
| sigma |
Network Reconnaissance Activity |
test |
2022-02-07 |
| sigma |
Suspicious Query of MachineGUID |
test |
2022-01-01 |
| sigma |
Suspicious Execution of Hostname |
test |
2022-01-01 |
| sigma |
Suspicious Kernel Dump Using Dtrace |
test |
2021-12-28 |
| suricata |
ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound |
rev 1 |
2021-11-18 |
| snort |
ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound |
rev 1 |
2021-11-18 |
| sigma |
System Information Discovery |
stable |
2021-09-14 |
| snort |
ET EXPLOIT Cisco Data Center Network Manager Information Disclosure Inbound |
rev 1 |
2021-07-24 |
| suricata |
ET EXPLOIT Cisco Data Center Network Manager Information Disclosure Inbound |
rev 1 |
2021-07-24 |
| suricata |
ET WEB_SPECIFIC_APPS Online Trade - Information Disclosure |
rev 3 |
2020-09-16 |
| suricata |
ET SCAN Hikvision IP Camera 5.4.0 Information Disclosure |
rev 2 |
2020-08-25 |
| suricata |
ET SCAN Geutebrueck re_porter 7.8.974.20 Information Disclosure |
rev 2 |
2020-08-25 |
| suricata |
ET WEB_SERVER DD-WRT Information Disclosure Attempt |
rev 6 |
2020-05-04 |
| suricata |
ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415 |
rev 1 |
2019-07-26 |
| snort |
ET WEB_SPECIFIC_APPS Jenkins Information Disclosure CVE-2017-1000395 |
rev 2 |
2019-05-10 |
| snort |
ET SCAN Hikvision IP Camera 5.4.0 Information Disclosure |
rev 2 |
2018-08-22 |
| snort |
ET SCAN Geutebrueck re_porter 7.8.974.20 Information Disclosure |
rev 2 |
2018-08-22 |
| snort |
ET WEB_SPECIFIC_APPS Online Trade - Information Disclosure |
rev 2 |
2018-07-05 |
| snort |
ET CURRENT_EVENTS Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M2 Dec 06 |
rev 1 |
2016-12-06 |
| snort |
ET CURRENT_EVENTS Internet Explorer Information Disclosure Vuln as Observed in RIG EK Prefilter M1 Dec 06 |
rev 1 |
2016-12-06 |
| snort |
ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415 |
rev 1 |
2016-09-29 |
| snort |
ET EXPLOIT Possible Internet Explorer VBscript failure to handle error case information disclosure CVE-2014-6332 Common Construct M2 |
rev 1 |
2016-05-06 |
| snort |
ET EXPLOIT Quanta LTE Router Information Disclosure Exploit Attempt |
rev 1 |
2016-04-05 |
| snort |
ET WEB_SERVER DD-WRT Information Disclosure Attempt |
rev 3 |
2011-02-17 |
| snort |
ET WEB_SERVER Successful DD-WRT Information Disclosure |
rev 2 |
2010-12-30 |