Detects usage of "vim" and it's siblings as a GTFOBin to execute and proxy command and binary execution

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Detects usage of "apt" and "apt-get" as a GTFOBin to execute and proxy command and binary execution

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Detects usage of "find" binary in a suspicious manner to perform discovery

Detects usage of "find" binary in a suspicious manner to perform discovery

Detects source code enumeration that use GET requests by keyword searches in URL strings

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Find information about network devices that is not stored in config files

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Detect adversaries enumerate sensitive files

Detects usage of system utilities to discover files and directories

Detects usage of system utilities to discover files and directories