Sigma detection rules, expert-reviewed

Obfuscated Encoded PowerShell Payload Deployed via Process Execution (via process_creation)

This rule detects deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Suspicious Windows Native Pktmon Sniffer Abuse (via process_creation)

This rule detects use the Windows sniffer Pktmon in order to capture sensitive information or credentials.

OpenSSH Server Listening on Socket (via openssh)

This rule detects enables the OpenSSH server and server starts to listening on SSH socket.

BITS Payload Downloaded via PowerShell (via powershell)

This rule detects downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

This rule detects wMIimplant.

Obfuscated Encoded PowerShell Payload Deployed - PowerShell (via powershell)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload.

Malicious Scheduled Task Created and Deleted Fastly - ATexec.py (via security)

This rule detects abuse task scheduler capacities to execute commands or elevate privileges.

SharpHound Host Enumeration Over Kerberos (via security)

This rule detects detect if a source host is requesting multiple Kerberos Service tickets (TGS) for different assets in a short period of time.

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

This rule detects clear the event logs.

DoT (DNS Over TLS) Activation - Command (via process_creation)

This rule detects enable DNS over TLS in order to evade detection for command and control purposes.

Suspicious System Time Changed (via security)

This rule detects change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.

Suspicious Success Login Attempt on a Windows OpenSSH Server (via security)

This rule detects connect to a Windows host using the SSH protocol.

SPN Enumeration Previous to Kerberoasting Attack - Native Commands (via process_creation)

This rule detects retrieve SPN using commandline and native tools.

Suspicious Modification of a Sensitive Group Policy - GPO (via security)

This rule detects will attempt to take control over a group policy.

Malicious Edge Abuse for Payload Download via Console (via process_creation)

This rule detects attemptes to download a payload directly via console.