Recursive directory listing issued from a Windows shell

Siemphony@siemphonylowT1083unverified

AN1040's real discriminator is MITRE's TimeWindow knob — more than fifty directory queries inside thirty seconds — which a single Sigma event cannot count, so this rule instead matches the command forms that ask for a whole tree in one call: `dir /s`, `tree /f`, `forfiles /s`, and PowerShell's `Get-ChildItem -Recurse` and its aliases. Each form is matched with a regex that requires the command word at a token boundary with its recursion flag following it, because an unordered substring pair ('dir' plus '/s') also matches unrelated command lines — a robocopy job against a folder named "Source Dir" run with /s, or a silent installer whose /s flag shares a line with any path containing 'dir'. That is a narrower slice of MITRE's CommandLineRegex knob than "any enumeration command", because a single non-recursive `dir` is indistinguishable from routine shell use and would swamp this rule. UserContext is not encoded — the brief calls for scoping standard versus service accounts, which needs an identity join this event does not carry — and a hand-rolled recursion loop or a compiled enumerator that never shells out to these four commands produces no match at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0370, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine matches regex "(?i)(?:^|[\\s&|(\"])dir(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)" or ProcessCommandLine matches regex "(?i)(?:^|[\\s&|(\"])tree(?:\\.com)?(?:\\s+[^&|;]+)?\\s+/f(?:[\\s\"]|$)" or ProcessCommandLine matches regex "(?i)forfiles(?:\\.exe)?(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)" or ProcessCommandLine matches regex "(?i)(?:^|[\\s;|({\"])(?:get-childitem|gci|ls|dir)(?:\\s+[^;|]+)?\\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\\s\"]|$)"))

Splunk · SPL

Run this as a search.

index=* | where ((match(Image, "(?i)\\\\cmd\\.exe$") OR match(Image, "(?i)\\\\powershell\\.exe$") OR match(Image, "(?i)\\\\pwsh\\.exe$")) AND (match(CommandLine, "(?:^|[\\s&|(\"])dir(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)") OR match(CommandLine, "(?:^|[\\s&|(\"])tree(?:\\.com)?(?:\\s+[^&|;]+)?\\s+/f(?:[\\s\"]|$)") OR match(CommandLine, "forfiles(?:\\.exe)?(?:\\s+[^&|;]+)?\\s+/s(?:[\\s\"]|$)") OR match(CommandLine, "(?:^|[\\s;|({\"])(?:get-childitem|gci|ls|dir)(?:\\s+[^;|]+)?\\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\\s\"]|$)")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)((?:^|[\s&amp;|(&quot;])dir(?:\s+[^&amp;|;]+)?\s+/s(?:[\s&quot;]|$)|(?:^|[\s&amp;|(&quot;])tree(?:\.com)?(?:\s+[^&amp;|;]+)?\s+/f(?:[\s&quot;]|$)|forfiles(?:\.exe)?(?:\s+[^&amp;|;]+)?\s+/s(?:[\s&quot;]|$)|(?:^|[\s;|({&quot;])(?:get-childitem|gci|ls|dir)(?:\s+[^;|]+)?\s+-(?:r|re|rec|recu|recur|recurs|recurse)(?:[\s&quot;]|$))</field>    <description>Recursive directory listing issued from a Windows shell</description>    <mitre>      <id>T1083</id>    </mitre>  </rule></group>

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: efcf797d-092a-45fd-b5e7-0c726c7548b3

ATT&CKT1083

T1083File and Directory Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery recon

01 · What this rule detects

An operator orienting themselves after gaining access — enumerating domain accounts, groups, shares, trusts and privileged users, usually within minutes of landing.

02 · Telemetry you need

Process creation with full command lines
Directory service query telemetry, where it is collected
The user and host context for each command
Accurate timestamps, since the sequence and pace carry the signal

03 · How the logic works

Individually these commands are unremarkable — whoami, net group, nltest and their equivalents are all legitimate. What distinguishes reconnaissance is density: several distinct discovery commands from one account on one host inside a few minutes. A single-command rule will drown you. The workable approach is either a correlation rule counting distinct discovery commands in a window, or a rule that fires on discovery commands run by accounts that have no business running them, such as a service account.

04 · Common false positives

Administrators doing exactly this work as part of their job
Inventory, asset management and compliance scanning tools
Login scripts that query group membership
Helpdesk staff diagnosing access problems

05 · Detection maturity

Tier 1 — starting point: Matches individual discovery commands. Expect high volume.
Tier 2 — tuned: Counts distinct discovery commands per user and host inside a time window.
Tier 3 — correlated: Weights by account type and correlates with recent first-time access to the host.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Count distinct commands rather than matching any single one
Weight by the account: a service account running whoami and net group is far more interesting than a domain admin doing so
Discovery within minutes of a first-ever logon to a host is a strong pairing
Keep the alert's evidence as the full command sequence — the individual commands mean little in isolation

Declared by the author

Build, packaging and CI scripts that run dir /s /b or Get-ChildItem -Recurse to enumerate a source or output tree before archiving it. On any developer or build-agent host this is a routine, repeated event and is the loudest match by a wide margin, which is what the level below reflects.
Backup, inventory and software-asset-management agents that walk every user profile or shared drive on a fixed schedule with a recursive dir or Get-ChildItem to build a file or size report.
Disk-usage and storage-cleanup tooling, including admin one-liners that use Get-ChildItem -Recurse or its dir/ls aliases while sizing a directory tree during routine troubleshooting.
Log and cache rotation tasks that call forfiles /s against an application log directory on a fixed schedule to find and prune old files.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1083, evaluated against their process_creation events.

Share this rule

/u/siemphony/efcf797d-092a-45fd-b5e7-0c726c7548b3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Recursive directory listing issued from a Windows shell

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Wazuh · XML rule

Elastic · ES|QL

Community

Verdicts from engineers who deployed it