Sigma detection rules, expert-reviewed

Windows Process Command Lines Indicating ngrok.exe Tunnel Setup

Detects Windows executions of ngrok.exe with TCP/HTTP tunneling and authtoken/start-all YAML configuration patterns.

Windows: Detect Rclone command execution with exfiltration-oriented flags

Identifies likely rclone.exe exfiltration activity on Windows by matching command-line flags and rclone executable characteristics.

Windows Service Creation Indicators for Moriya Rootkit (ZzNetSvc via Service Control Manager)

Alerts on creation of the "ZzNetSvc" service by Service Control Manager (Event ID 7045) on Windows.

Windows whoami.exe Privilege Enumeration Using /priv Flag

Alerts on whoami.exe runs with /priv or -priv to enumerate current user privileges.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows Security: Hidden Local User Account Creation (Event ID 4720)

Alerts on Windows 4720 local user creation for hidden accounts (username ending with '$'), excluding 'HomeGroupUser$'.

Windows Process Access to svchost.exe with Credential Dumping Access Rights

Alerts on attempts to read svchost.exe memory consistent with credential dumping, excluding known benign callers.

PowerShell Defender Exclusion via Set/Add-MpPreference Command-Line Flags (Windows)

Detects PowerShell commands that add or set Microsoft Defender exclusions using Add/Set-MpPreference parameters.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate

Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Flags Windows Hybrid Connection Manager-related events mentioning sb:// and servicebus.windows.net.

Windows Security Event 4697: HybridConnectionManager Service Installation

Alerts on HybridConnectionManager service installation on Windows via Security Event ID 4697.

Windows Registry: Outlook Macro Security Level Set to Enable All Macros

Detects Outlook macro warning bypass by setting the Outlook security level registry value to enable all macros.