AN1040
Analytic 1040
Windows
Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
[CommandLineRegex]
Allows tuning based on tools/scripts used for enumeration (e.g., tree, dir /s /b)
[UserContext]
Scoping for standard vs elevated or service accounts
[TimeWindow]
Defines burst activity over short periods (e.g., >50 directory queries in 30s)
AN1041
Analytic 1041
Linux
Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.
auditd:SYSCALL
execve
auditd:PATH
PATH
[FilePathDepth]
Max depth of recursive access to tune noise vs anomaly
[UserContext]
Helpful to exclude known scripts or automation accounts
AN1042
Analytic 1042
macOS
Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.
macos:unifiedlog
log collect --predicate
fs:fsusage
Filesystem Call Monitoring
[PredicateScope]
Adjust macOS unified log filter to include/exclude system paths
[TimeWindow]
Tune based on burst access patterns
AN1043
Analytic 1043
ESXi
Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.
esxi:shell
Shell Access/Command Execution
esxi:hostd
vSphere File API Access
[CLICommandPattern]
Match on esxcli storage|filesystem commands
[AccessSource]
Limit alerting to non-vCenter or remote IPs
AN1044
Analytic 1044
Network Devices
Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.
networkdevice:syslog
CLI Command Logging
[CommandWhitelist]
Filter allowed commands by account or IP
[SessionOrigin]
Tunable to restrict detection to remote terminal or Telnet/SSH