Recursive directory listing issued from a Windows shell

Siemphony@siemphonylowT1083unverifiedPlaybook · Discovery and enumeration

AN1040's real discriminator is MITRE's TimeWindow knob — more than fifty directory queries inside thirty seconds — which a single Sigma event cannot count, so this rule instead matches the command forms that ask for a whole tree in one call: `dir /s`, `tree /f`, `forfiles /s`, and PowerShell's `Get-ChildItem -Recurse` and its aliases. Each form is matched with a regex that requires the command word at a token boundary with its recursion flag following it, because an unordered substring pair ('dir' plus '/s') also matches unrelated command lines — a robocopy job against a folder named "Source Dir" run with /s, or a silent installer whose /s flag shares a line with any path containing 'dir'. That is a narrower slice of MITRE's CommandLineRegex knob than "any enumeration command", because a single non-recursive `dir` is indistinguishable from routine shell use and would swamp this rule. UserContext is not encoded — the brief calls for scoping standard versus service accounts, which needs an identity join this event does not carry — and a hand-rolled recursion loop or a compiled enumerator that never shells out to these four commands produces no match at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0370, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Recursive directory listing issued from a Windows shell2id: efcf797d-092a-45fd-b5e7-0c726c7548b33status: experimental4description: |5  AN1040's real discriminator is MITRE's TimeWindow knob — more than fifty6  directory queries inside thirty seconds — which a single Sigma event cannot7  count, so this rule instead matches the command forms that ask for a whole8  tree in one call: `dir /s`, `tree /f`, `forfiles /s`, and PowerShell's9  `Get-ChildItem -Recurse` and its aliases. Each form is matched with a regex10  that requires the command word at a token boundary with its recursion flag11  following it, because an unordered substring pair ('dir' plus '/s') also12  matches unrelated command lines — a robocopy job against a folder named13  "Source Dir" run with /s, or a silent installer whose /s flag shares a line14  with any path containing 'dir'. That is a narrower slice of MITRE's15  CommandLineRegex knob than "any enumeration command", because a single16  non-recursive `dir` is indistinguishable from routine shell use and would17  swamp this rule. UserContext is not encoded — the brief calls for scoping18  standard versus service accounts, which needs an identity join this event does19  not carry — and a hand-rolled recursion loop or a compiled enumerator that20  never shells out to these four commands produces no match at all.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0370, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T108324  - https://attack.mitre.org/detectionstrategies/DET037025author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.discovery29  - attack.t108330logsource:31  category: process_creation32  product: windows33detection:34  selection_shell:35    Image|endswith:36      - '\cmd.exe'37      - '\powershell.exe'38      - '\pwsh.exe'39  selection_recurse:40    CommandLine|re:41      - '(?:^|[\s&|("])dir(?:\s+[^&|;]+)?\s+/s(?:[\s"]|$)'42      - '(?:^|[\s&|("])tree(?:\.com)?(?:\s+[^&|;]+)?\s+/f(?:[\s"]|$)'43      - 'forfiles(?:\.exe)?(?:\s+[^&|;]+)?\s+/s(?:[\s"]|$)'44      - '(?:^|[\s;|({"])(?:get-childitem|gci|ls|dir)(?:\s+[^;|]+)?\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\s"]|$)'45  condition: selection_shell and selection_recurse46falsepositives:47  - "Build, packaging and CI scripts that run `dir /s /b` or `Get-ChildItem -Recurse` to enumerate a source or output tree before archiving it. On any developer or build-agent host this is a routine, repeated event and is the loudest match by a wide margin, which is what the level below reflects."48  - "Backup, inventory and software-asset-management agents that walk every user profile or shared drive on a fixed schedule with a recursive `dir` or `Get-ChildItem` to build a file or size report."49  - "Disk-usage and storage-cleanup tooling, including admin one-liners that use `Get-ChildItem -Recurse` or its `dir`/`ls` aliases while sizing a directory tree during routine troubleshooting."50  - "Log and cache rotation tasks that call `forfiles /s` against an application log directory on a fixed schedule to find and prune old files."51level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine matches regex "(?i)(?:^|[\\s&|(\"])dir(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)" or ProcessCommandLine matches regex "(?i)(?:^|[\\s&|(\"])tree(?:\\.com)?(?:\\s+[^&|;]+)?\\s+/f(?:[\\s\"]|$)" or ProcessCommandLine matches regex "(?i)forfiles(?:\\.exe)?(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)" or ProcessCommandLine matches regex "(?i)(?:^|[\\s;|({\"])(?:get-childitem|gci|ls|dir)(?:\\s+[^;|]+)?\\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\\s\"]|$)"))

Splunk · SPL

Run this as a search.

index=* | where ((match(Image, "(?i)\\\\cmd\\.exe$") OR match(Image, "(?i)\\\\powershell\\.exe$") OR match(Image, "(?i)\\\\pwsh\\.exe$")) AND (match(CommandLine, "(?:^|[\\s&|(\"])dir(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)") OR match(CommandLine, "(?:^|[\\s&|(\"])tree(?:\\.com)?(?:\\s+[^&|;]+)?\\s+/f(?:[\\s\"]|$)") OR match(CommandLine, "forfiles(?:\\.exe)?(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)") OR match(CommandLine, "(?:^|[\\s;|({\"])(?:get-childitem|gci|ls|dir)(?:\\s+[^;|]+)?\\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\\s\"]|$)")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)((?:^|[\s&amp;|(&quot;])dir(?:\s+[^&amp;|;]+)?\s+/s(?:[\s&quot;]|$)|(?:^|[\s&amp;|(&quot;])tree(?:\.com)?(?:\s+[^&amp;|;]+)?\s+/f(?:[\s&quot;]|$)|forfiles(?:\.exe)?(?:\s+[^&amp;|;]+)?\s+/s(?:[\s&quot;]|$)|(?:^|[\s;|({&quot;])(?:get-childitem|gci|ls|dir)(?:\s+[^;|]+)?\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\s&quot;]|$))</field>    <description>Recursive directory listing issued from a Windows shell</description>    <mitre>      <id>T1083</id>    </mitre>  </rule></group>

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: efcf797d-092a-45fd-b5e7-0c726c7548b3

ATT&CKT1083

T1083File and Directory Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1083, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add additional conditions to filter out known legitimate sources of recursive directory listing commands, such as specific process names or command line arguments
Modify the regular expressions to be more specific and reduce false positives, such as by adding more context to the command line matches
Add a threshold to the rule to only flag events where multiple recursive directory listing commands are issued within a short time frame

Declared by the author

Build, packaging and CI scripts that run dir /s /b or Get-ChildItem -Recurse to enumerate a source or output tree before archiving it. On any developer or build-agent host this is a routine, repeated event and is the loudest match by a wide margin, which is what the level below reflects.
Backup, inventory and software-asset-management agents that walk every user profile or shared drive on a fixed schedule with a recursive dir or Get-ChildItem to build a file or size report.
Disk-usage and storage-cleanup tooling, including admin one-liners that use Get-ChildItem -Recurse or its dir/ls aliases while sizing a directory tree during routine troubleshooting.
Log and cache rotation tasks that call forfiles /s against an application log directory on a fixed schedule to find and prune old files.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects recursive directory listing commands issued from a Windows shell, which can be an indicator of discovery and reconnaissance activity by an attacker. The rule looks for commands that list directory contents recursively, such as dir /s, tree /f, forfiles /s, and PowerShell commands like Get-ChildItem -Recurse. This behavior is separated from normal activity by the recursive nature of the directory listing, which can be a sign of an attacker attempting to gather information about the system.

02 · Telemetry you need

Log source: process creation logs
Specific fields: Image, CommandLine
Audit setting: process creation logging must be enabled, which may be off by default in some Windows configurations

03 · How the logic works

The rule selects events where the image is a Windows shell executable (cmd.exe, powershell.exe, or pwsh.exe) and the command line contains a recursive directory listing command. The command line is checked using regular expressions to match various forms of the commands, including dir /s, tree /f, forfiles /s, and PowerShell commands like Get-ChildItem -Recurse. If both conditions are met, the event is flagged as a potential discovery and reconnaissance activity.

04 · Common false positives

System administration tools that use recursive directory listing for legitimate purposes, such as backup software or system monitoring tools
Developer environments where recursive directory listing is used for debugging or testing purposes
Automated scripts or workflows that use recursive directory listing for tasks like data migration or synchronization

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives and requires significant tuning to be effective.
tier_2: With additional filtering and thresholding, the rule can be tuned to reduce noise and generate more accurate alerts.
tier_3: Correlating this rule with other signals, such as suspicious network activity or unusual login attempts, can help to confirm the presence of an attacker and provide a more comprehensive understanding of the threat.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/efcf797d-092a-45fd-b5e7-0c726c7548b3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Recursive directory listing issued from a Windows shell

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Wazuh · XML rule

Elastic · ES|QL

Community

Verdicts from engineers who deployed it