Detection rules › Sigma

File And SubFolder Enumeration Via Dir Command

Severity
low
Author
frack113
Source
upstream

Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1217 Browser Information Discovery

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_cmd

or:
Image|endswith: '\cmd.exe'
OriginalFileName: Cmd.Exe

Stage 2: all of selection_cli

CommandLine|contains: 'dir*-s'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • dir*-s
Imageends_with
  • \cmd.exe corpus 92 (sigma 92)
OriginalFileNameeq
  • Cmd.Exe corpus 32 (sigma 30, splunk 2)