Skip to content

Catalogue
ATT&CK

Sign in Get started

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@sunturai.com

© 2026 Sunturai.

MediumΣSigmaHQ

Suspicious Use of PsLogList

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

ATT&CK coverage

Outside the enterprise matrix

T1087
T1087.001
T1087.002

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

Another tool that uses the command line switches of PsLogList
Legitimate use of PsLogList by an administrator

References

https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList
https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
https://twitter.com/EricaZelic/status/1614075109827874817
https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos

Tagged by the source as

attack.discovery

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Nasreddine Bencherchali (Nextron Systems)
Licence: Detection Rule License 1.1Read the licence
Published: Aug 26, 2026
Version: 1

See also

3,144 from SigmaHQ 4,138 rated medium