Sigma detection rules, expert-reviewed

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

This rule detects enable or reconfigure BitLocker on multiple hosts for ransomware purposes.

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

This rule detects sSH brutforce a Windows OpenSSH server with non existing users.

Malicious Massive Remote Service Creation via Named Pipes - Tchopper (via security)

This rule detects uses the Tchopper tool by remotely creating multiple services via named pipes.

Malicious Audit Policy Disabled by Command Line (via process_creation)

This rule detects disbale or clear the audit policy for defense evasion purposes.

Malicious Shared Folder Access with Forged Golden Ticket (via security)

This rule detects used a forged Golden ticket to login on a remote shared folder. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.

Malicious User Files Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump user profile information via network share.

Malicious LSASS Credential Dump with LSASSY - Kernel Access (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

SystemNightmare by GentilKiwi - External Printer Mapped - CVE-2021-1675 / CVE-2021-34527 (via security)

This rule detects exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi.

Obfuscated RDP Tunneling Configuration Enabled for Port Forwarding (via process_creation)

This rule detects configure port forwarding on a host to redirect traffic to a C&C target.

Malicious Metasploit Reverse Shell Injection in SQL Server (via process_creation)

This rule detects inject a payload into SQL Server in order to obtain a remote shell.

Malicious Impacket WMIexec Process Execution (via process_creation)

This rule detects execute WMIexec in order to escalate privileges.

Malicious Fortinet APT Group Abuse on Windows - User (via security)

This rule detects scenarios where APT actors exploits Fortinet vulnerabilities to gain access into Windows infrastructure.

Malicious Service Abuse with Backdoored "command Failure" - Reg via PowerShell (via powershell)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

Malicious Rubeus Kerberos Unconstrained Delegation Abuse (via security)

This rule detects abuse Kerberos unconstrained delegation for domain persistence.

Malicious Stickey Key Called CMD via Command Execution - Hash Detection (via process_creation)

This rule detects calls the stickey key and execute CMD.