Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1083

File and Directory Discovery

Discovery 99 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
sigma Powershell Sensitive File Discovery test 2026-10-14
elastic OpenAI ChatGPT Enterprise Google Drive Sensitive Query Burst production 2026-10-09
elastic OpenAI ChatGPT Enterprise Slack Query Burst production 2026-10-09
elastic OpenAI ChatGPT Enterprise Suspicious Gmail Discovery production 2026-10-09
elastic ESXI Discovery via Grep production 2026-10-09
elastic Security File Access via Common Utilities production 2026-10-09
splunk Linux Auditd File And Directory Discovery production 2026-10-02
elastic ESXi Virtual Disk Files Enumerated production 2026-09-30
elastic Potential Credential Discovery via Recursive Grep production 2026-09-18
elastic Process Capability Enumeration production 2026-09-18
elastic Private Key Searching Activity production 2026-09-18
elastic Kubeconfig File Discovery production 2026-09-18
elastic AWS Credentials Searched For Inside A Container production 2026-09-18
elastic Full Disk Access Permission Check production 2026-09-18
elastic Suspicious System Commands Executed by Previously Unknown Executable production 2026-09-18
elastic Yum/DNF Plugin Status Discovery production 2026-09-18
elastic Suspicious which Enumeration production 2026-09-18
elastic Suspicious Memory grep Activity production 2026-09-18
elastic SUID/SGUID Enumeration Detected production 2026-09-18
elastic Suspicious Dynamic Linker Discovery via od production 2026-09-18
elastic Sensitive Keys Or Passwords Searched For Inside A Container production 2026-09-18
elastic Kernel Instrumentation Discovery via kprobes and tracefs production 2026-09-18
elastic Web Server Local File Inclusion Activity production 2026-09-18
elastic Web Server Potential Remote File Inclusion Activity production 2026-09-18
elastic Cloud Credential Search Detected via Defend for Containers production 2026-09-18
elastic Sensitive Keys Or Passwords Search Detected via Defend for Containers production 2026-09-18
elastic Kubelet Pod Discovery Detected via Defend for Containers production 2026-09-18
elastic ESXI Discovery via Find production 2026-09-18
sigma Vim GTFOBin Abuse - Linux test 2026-06-05
splunk Linux Auditd Hidden Files And Directories Creation production 2026-05-13
splunk Linux Auditd Database File And Directory Discovery production 2026-05-13
splunk Linux Auditd Virtual Disk File And Directory Discovery production 2026-05-13
sigma Capabilities Discovery - Linux test 2026-01-24
sigma WannaCry Ransomware Activity test 2025-10-18
sigma PUA - TruffleHog Execution - Linux experimental 2025-09-24
sigma PUA - TruffleHog Execution experimental 2025-09-24
sigma Notepad Password Files Discovery experimental 2025-02-21
sigma File and Directory Discovery - Linux test 2024-12-01
snort ET WEB_SPECIFIC_APPS Dicoogle PACS 2.5.0 - Directory Traversal rev 3 2024-11-26
snort ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt rev 2 2024-11-26
suricata ET WEB_SERVER possible SAP Crystal Report Server 2008 path parameter Directory Traversal vulnerability rev 5 2024-11-26
suricata GPL EXPLOIT unicode directory traversal attempt rev 17 2024-11-26
suricata GPL EXPLOIT unicode directory traversal attempt rev 14 2024-11-26
suricata GPL EXPLOIT unicode directory traversal attempt rev 22 2024-11-26
suricata ET EXPLOIT HP Printer Attempted Path Traversal via PJL rev 5 2024-11-26
suricata ET EXPLOIT Cisco Adaptive Security Appliance - Path Traversal rev 3 2024-11-26
suricata GPL FTP LIST directory traversal attempt rev 12 2024-11-26
suricata ET HUNTING Outbound POST Request with Zipped Directory Traversal Filename rev 2 2024-11-26
suricata GPL RPC kcms_server directory traversal attempt rev 13 2024-11-26
suricata ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal rev 15 2024-11-26
suricata ET WEB_SERVER Possible SUPERMICRO IPMI url_redirect.cgi Directory Traversal Attempt rev 4 2024-11-26
suricata GPL WEB_SERVER Tomcat directory traversal attempt rev 15 2024-11-26
suricata ET WEB_SPECIFIC_APPS Adobe JRun Directory Traversal rev 11 2024-11-26
suricata ET WEB_SPECIFIC_APPS Business Objects Crystal Reports Web Form Viewer Directory Traversal Attempt rev 9 2024-11-26
suricata ET WEB_SPECIFIC_APPS f-fileman direkt Parameter Directory Traversal Vulnerability rev 5 2024-11-26
suricata ET WEB_SPECIFIC_APPS Joomla Component com_jr_questionnaire Directory Traversal Attempt rev 6 2024-11-26
suricata ET WEB_SPECIFIC_APPS Joomla component Simple File Lister sflDir Parameter directory traversal attempt rev 6 2024-11-26
suricata ET WEB_SPECIFIC_APPS Webmin Directory Traversal rev 7 2024-11-26
suricata ET WEB_SPECIFIC_APPS Dicoogle PACS 2.5.0 - Directory Traversal rev 4 2024-11-26
suricata ET WEB_SPECIFIC_APPS Oracle JSF2 Path Traversal Attempt rev 5 2024-11-26
snort GPL EXPLOIT unicode directory traversal attempt rev 15 2024-11-26
snort GPL EXPLOIT unicode directory traversal attempt rev 13 2024-11-26
snort GPL EXPLOIT unicode directory traversal attempt rev 16 2024-11-26
snort ET EXPLOIT HP Printer Attempted Path Traversal via PJL rev 4 2024-11-26
snort ET EXPLOIT Cisco Adaptive Security Appliance - Path Traversal rev 3 2024-11-26
snort GPL FTP LIST directory traversal attempt rev 10 2024-11-26
snort ET INFO Outbound POST Request with Zipped Directory Traversal Filename rev 2 2024-11-26
snort GPL RPC kcms_server directory traversal attempt rev 12 2024-11-26
snort ET WEB_SERVER HP OpenView Network Node Manager CGI Directory Traversal rev 11 2024-11-26
snort ET WEB_SERVER possible SAP Crystal Report Server 2008 path parameter Directory Traversal vulnerability rev 2 2024-11-26
snort ET WEB_SERVER Possible SUPERMICRO IPMI url_redirect.cgi Directory Traversal Attempt rev 2 2024-11-26
snort GPL WEB_SERVER Tomcat directory traversal attempt rev 12 2024-11-26
snort ET WEB_SPECIFIC_APPS Adobe JRun Directory Traversal rev 6 2024-11-26
snort ET WEB_SPECIFIC_APPS Business Objects Crystal Reports Web Form Viewer Directory Traversal Attempt rev 4 2024-11-26
snort ET WEB_SPECIFIC_APPS f-fileman direkt Parameter Directory Traversal Vulnerability rev 2 2024-11-26
snort ET WEB_SPECIFIC_APPS Joomla Component com_jr_questionnaire Directory Traversal Attempt rev 3 2024-11-26
snort ET WEB_SPECIFIC_APPS Joomla component Simple File Lister sflDir Parameter directory traversal attempt rev 3 2024-11-26
snort ET WEB_SPECIFIC_APPS Webmin Directory Traversal rev 3 2024-11-26
sigma HackTool - PCHunter Execution test 2024-11-23
snort ET WEB_SPECIFIC_APPS Wordpress WPLMS Learning Management System Directory Traversal rev 1 2024-11-18
suricata ET WEB_SPECIFIC_APPS Wordpress WPLMS Learning Management System Directory Traversal rev 1 2024-11-18
sigma Shell Invocation via Apt - Linux test 2024-09-02
sigma Shell Execution via Nice - Linux test 2024-09-02
sigma Shell Execution GCC - Linux test 2024-09-02
sigma Shell Execution via Flock - Linux test 2024-09-02
sigma Shell Execution via Find - Linux test 2024-09-02
suricata ET EXPLOIT Possible Magento Directory Traversal Attempt rev 4 2024-04-20
sigma DirLister Execution test 2023-02-04
sigma PUA - Seatbelt Execution test 2023-02-04
sigma Cisco Discovery test 2023-01-04
sigma Potential Discovery Activity Using Find - Linux test 2022-12-28
sigma Potential Discovery Activity Using Find - MacOS test 2022-12-28
sigma Linux Capabilities Discovery test 2022-12-25
sigma File and Directory Discovery - MacOS test 2022-11-25
sigma Turla Group Lateral Movement test 2022-10-09
sigma Source Code Enumeration Detection by Keyword test 2022-10-05
elastic File and Directory Discovery deprecated 2022-08-02
sigma Powershell Directory Enumeration test 2022-03-17
snort ET CURRENT_EVENTS Possible Magento Directory Traversal Attempt rev 1 2015-10-15