1200KM / tag
attack.discovery — sigma-tag tag
227 related reference pages for sigma-tag: attack.discovery.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Active Directory Computers Enumeration With Get-AdComputer · sigma-rule
- Active Directory Database Snapshot Via ADExplorer · sigma-rule
- Active Directory Group Enumeration With Get-AdGroup · sigma-rule
- Active Directory Structure Export Via Csvde.EXE · sigma-rule
- AD Groups Or Users Enumeration Using PowerShell - PoshModule · sigma-rule
- AD Groups Or Users Enumeration Using PowerShell - ScriptBlock · sigma-rule
- AD Privileged Users or Groups Reconnaissance · sigma-rule
- ADExplorer Writing Complete AD Snapshot Into .dat File · sigma-rule
- Advanced IP Scanner - File Event · sigma-rule
- Automated Collection Bookmarks Using Get-ChildItem PowerShell · sigma-rule
- AWS STS GetCallerIdentity Enumeration Via TruffleHog · sigma-rule
- Azure AD Health Monitoring Agent Registry Keys Access · sigma-rule
- Azure AD Health Service Agents Registry Keys Access · sigma-rule
- Bitbucket User Details Export Attempt Detected · sigma-rule
- Bitbucket User Permissions Export Attempt · sigma-rule
- BloodHound Collection Files · sigma-rule
- Capabilities Discovery - Linux · sigma-rule
- Chopper Webshell Process Pattern · sigma-rule
- Cisco Collect Data · sigma-rule
- Cisco Discovery · sigma-rule
- Cisco Sniffing · sigma-rule
- Computer Discovery And Export Via Get-ADComputer Cmdlet · sigma-rule
- Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell · sigma-rule
- Computer System Reconnaissance Via Wmic.EXE · sigma-rule
- Console CodePage Lookup Via CHCP · sigma-rule
- Container Residence Discovery Via Proc Virtual FS · sigma-rule
- Crontab Enumeration · sigma-rule
- Detected Windows Software Discovery · sigma-rule
- Detected Windows Software Discovery - PowerShell · sigma-rule
- DirectorySearcher Powershell Exploitation · sigma-rule
- DirLister Execution · sigma-rule
- Discovery of a System Time · sigma-rule
- Discovery Using AzureHound · sigma-rule
- DNS Server Discovery Via LDAP Query · sigma-rule
- Docker Container Discovery Via Dockerenv Listing · sigma-rule
- Domain Trust Discovery Via Dsquery · sigma-rule
- Enumerate All Information With Whoami.EXE · sigma-rule
- ESXi Network Configuration Discovery Via ESXCLI · sigma-rule
- ESXi Storage Information Discovery Via ESXCLI · sigma-rule
- ESXi System Information Discovery Via ESXCLI · sigma-rule
- ESXi VM List Discovery Via ESXCLI · sigma-rule
- ESXi VSAN Information Discovery Via ESXCLI · sigma-rule
- Exports Critical Registry Keys To a File · sigma-rule
- Exports Registry Key To a File · sigma-rule
- File and Directory Discovery - Linux · sigma-rule
- File and Directory Discovery - MacOS · sigma-rule
- File And SubFolder Enumeration Via Dir Command · sigma-rule
- File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell · sigma-rule
- Firewall Configuration Discovery Via Netsh.EXE · sigma-rule
- Fsutil Drive Enumeration · sigma-rule
- Get-ADUser Enumeration Using UserAccountControl Flags · sigma-rule
- Github Self Hosted Runner Changes Detected · sigma-rule
- Gpresult Display Group Policy Information · sigma-rule
- Group Membership Reconnaissance Via Whoami.EXE · sigma-rule
- HackTool - Bloodhound/Sharphound Execution · sigma-rule
- HackTool - Certify Execution · sigma-rule
- HackTool - Certipy Execution · sigma-rule
- HackTool - CrackMapExec Execution · sigma-rule
- HackTool - NetExec Execution · sigma-rule
- HackTool - NetExec File Indicators · sigma-rule
- HackTool - PCHunter Execution · sigma-rule
- HackTool - SharpLdapWhoami Execution · sigma-rule
- HackTool - SharpUp PrivEsc Tool Execution · sigma-rule
- HackTool - SharpView Execution · sigma-rule
- HackTool - SOAPHound Execution · sigma-rule
- HackTool - TruffleSnout Execution · sigma-rule
- HackTool - winPEAS Execution · sigma-rule
- HackTool - WinPwn Execution · sigma-rule
- HackTool - WinPwn Execution - ScriptBlock · sigma-rule
- Hacktool Ruler · sigma-rule
- Harvesting Of Wifi Credentials Via Netsh.EXE · sigma-rule
- Kubernetes Potential Enumeration Activity · sigma-rule
- Linux Capabilities Discovery · sigma-rule
- Linux Network Service Scanning - Auditd · sigma-rule
- Linux Network Service Scanning Tools Execution · sigma-rule
- Linux Remote System Discovery · sigma-rule
- Local Accounts Discovery · sigma-rule
- Local Groups Discovery - Linux · sigma-rule
- Local Groups Discovery - MacOs · sigma-rule
- Local Groups Reconnaissance Via Wmic.EXE · sigma-rule
- Local System Accounts Discovery - Linux · sigma-rule
- Local System Accounts Discovery - MacOs · sigma-rule
- MacOS Network Service Scanning · sigma-rule
- Macos Remote System Discovery · sigma-rule
- Malicious PowerShell Commandlets - PoshModule · sigma-rule
- Malicious PowerShell Commandlets - ProcessCreation · sigma-rule
- Malicious PowerShell Commandlets - ScriptBlock · sigma-rule
- Network Reconnaissance Activity · sigma-rule
- Network Sniffing - Linux · sigma-rule
- Network Sniffing - MacOs · sigma-rule
- New Network Trace Capture Started Via Netsh.EXE · sigma-rule
- Nltest.EXE Execution · sigma-rule
- Notepad Password Files Discovery · sigma-rule
- OpenCanary - Host Port Scan (SYN Scan) · sigma-rule
- OpenCanary - NMAP FIN Scan · sigma-rule
- OpenCanary - NMAP NULL Scan · sigma-rule
- OpenCanary - NMAP OS Scan · sigma-rule
- OpenCanary - NMAP XMAS Scan · sigma-rule
- OpenCanary - SNMP OID Request · sigma-rule
- OS Architecture Discovery Via Grep · sigma-rule
- Password Policy Discovery - Linux · sigma-rule
- Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy · sigma-rule
- Password Policy Enumerated · sigma-rule
- Permission Check Via Accesschk.EXE · sigma-rule
- PktMon.EXE Execution · sigma-rule
- Pnscan Binary Data Transmission Activity · sigma-rule
- Possible DCSync Attack · sigma-rule
- Potential Active Directory Reconnaissance/Enumeration Via LDAP · sigma-rule
- Potential AD User Enumeration From Non-Machine Account · sigma-rule
- Potential Bucket Enumeration on AWS · sigma-rule
- Potential Configuration And Service Reconnaissance Via Reg.EXE · sigma-rule
- Potential Container Discovery Via Inodes Listing · sigma-rule
- Potential Discovery Activity Using Find - Linux · sigma-rule
- Potential Discovery Activity Using Find - MacOS · sigma-rule
- Potential GobRAT File Discovery Via Grep · sigma-rule
- Potential Network Sniffing Activity Using Network Tools · sigma-rule
- Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock · sigma-rule
- Potential Process Reconnaissance via Wmic.EXE · sigma-rule
- Potential Product Class Reconnaissance Via Wmic.EXE · sigma-rule
- Potential Recon Activity Via Nltest.EXE · sigma-rule
- Potential Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
- Potential Suspicious Activity Using SeCEdit · sigma-rule
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock · sigma-rule
- Potentially Suspicious EventLog Recon Activity Using Log Query Utilities · sigma-rule
- PowerShell ADRecon Execution · sigma-rule
- Powershell Detect Virtualization Environment · sigma-rule
- Powershell Directory Enumeration · sigma-rule
- Powershell Sensitive File Discovery · sigma-rule
- Powershell Suspicious Win32_PnPEntity · sigma-rule
- PUA - AdFind Suspicious Execution · sigma-rule
- PUA - AdFind.EXE Execution · sigma-rule
- PUA - Adidnsdump Execution · sigma-rule
- PUA - Advanced IP Scanner Execution · sigma-rule
- PUA - Advanced IP/Port Scanner Update Check · sigma-rule
- PUA - Advanced Port Scanner Execution · sigma-rule
- PUA - Crassus Execution · sigma-rule
- PUA - NimScan Execution · sigma-rule
- PUA - Nmap/Zenmap Execution · sigma-rule
- PUA - Process Hacker Execution · sigma-rule
- PUA - Seatbelt Execution · sigma-rule
- PUA - SoftPerfect Netscan Execution · sigma-rule
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE · sigma-rule
- PUA - System Informer Execution · sigma-rule
- PUA - TruffleHog Execution · sigma-rule
- PUA - TruffleHog Execution - Linux · sigma-rule
- Python Initiated Connection · sigma-rule
- RBAC Permission Enumeration Attempt · sigma-rule
- Recon Command Output Piped To Findstr.EXE · sigma-rule
- Reconnaissance Activity · sigma-rule
- Registry Enumeration via WMI Stdregprov · sigma-rule
- Renamed AdFind Execution · sigma-rule
- Renamed Whoami Execution · sigma-rule
- SAM Registry Hive Handle Request · sigma-rule
- SCM Database Handle Failure · sigma-rule
- Security Privileges Enumeration Via Whoami.EXE · sigma-rule
- Security Software Discovery - Linux · sigma-rule
- Security Software Discovery - MacOs · sigma-rule
- Security Software Discovery Via Powershell Script · sigma-rule
- Security Tools Keyword Lookup Via Findstr.EXE · sigma-rule
- Share And Session Enumeration Using Net.EXE · sigma-rule
- SharpHound Recon Account Discovery · sigma-rule
- SharpHound Recon Sessions · sigma-rule
- Shell Execution GCC - Linux · sigma-rule
- Shell Execution via Find - Linux · sigma-rule
- Shell Execution via Flock - Linux · sigma-rule
- Shell Execution via Nice - Linux · sigma-rule
- Shell Invocation via Apt - Linux · sigma-rule
- Source Code Enumeration Detection by Keyword · sigma-rule
- Suspicious Active Directory Database Snapshot Via ADExplorer · sigma-rule
- Suspicious Execution of Hostname · sigma-rule
- Suspicious Execution of Systeminfo · sigma-rule
- Suspicious File Access to Browser Credential Storage · sigma-rule
- Suspicious Get Information for SMB Share · sigma-rule
- Suspicious Get Information for SMB Share - PowerShell Module · sigma-rule
- Suspicious Get Local Groups Information · sigma-rule
- Suspicious Get Local Groups Information - PowerShell · sigma-rule
- Suspicious GPO Discovery With Get-GPO · sigma-rule
- Suspicious Group And Account Reconnaissance Activity Using Net.EXE · sigma-rule
- Suspicious Kernel Dump Using Dtrace · sigma-rule
- Suspicious Network Command · sigma-rule
- Suspicious Network Connection to IP Lookup Service APIs · sigma-rule
- Suspicious PowerShell Get Current User · sigma-rule
- Suspicious Process Discovery With Get-Process · sigma-rule
- Suspicious Query of MachineGUID · sigma-rule
- Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet · sigma-rule
- Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS · sigma-rule
- Suspicious Scan Loop Network · sigma-rule
- Suspicious Use of PsLogList · sigma-rule
- Suspicious Where Execution · sigma-rule
- Sysinternals PsService Execution · sigma-rule
- Sysinternals PsSuspend Execution · sigma-rule
- SysKey Registry Keys Access · sigma-rule
- Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE · sigma-rule
- System and Hardware Information Discovery · sigma-rule
- System Disk And Volume Reconnaissance Via Wmic.EXE · sigma-rule
- System Info Discovery via Sysinfo Syscall · sigma-rule
- System Information Discovery · sigma-rule
- System Information Discovery - Auditd · sigma-rule
- System Information Discovery Using Ioreg · sigma-rule
- System Information Discovery Using sw_vers · sigma-rule
- System Information Discovery Using System_Profiler · sigma-rule
- System Information Discovery via Registry Queries · sigma-rule
- System Information Discovery Via Sysctl - MacOS · sigma-rule
- System Integrity Protection (SIP) Disabled · sigma-rule
- System Integrity Protection (SIP) Enumeration · sigma-rule
- System Language Discovery via Reg.Exe · sigma-rule
- System Network Connections Discovery - Linux · sigma-rule
- System Network Connections Discovery - MacOs · sigma-rule
- System Network Connections Discovery Via Net.EXE · sigma-rule
- System Network Discovery - Linux · sigma-rule
- System Network Discovery - macOS · sigma-rule
- System Owner or User Discovery - Linux · sigma-rule
- Uncommon Connection to Active Directory Web Services · sigma-rule
- Uncommon System Information Discovery Via Wmic.EXE · sigma-rule
- Use Get-NetTCPConnection · sigma-rule
- Use Get-NetTCPConnection - PowerShell Module · sigma-rule
- Use of W32tm as Timer · sigma-rule
- User Discovery And Export Via Get-ADUser Cmdlet · sigma-rule
- User Discovery And Export Via Get-ADUser Cmdlet - PowerShell · sigma-rule
- Vim GTFOBin Abuse - Linux · sigma-rule
- Webshell Detection With Command Line Keywords · sigma-rule
- Webshell Hacking Activity Patterns · sigma-rule
- WhoAmI as Parameter · sigma-rule
- Whoami.EXE Execution Anomaly · sigma-rule
- Whoami.EXE Execution From Privileged Process · sigma-rule
- Whoami.EXE Execution With Output Option · sigma-rule
- Windows Pcap Drivers · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.