Sigma detection rules, expert-reviewed

Malicious WMI Registration - PowerShell (via powershell)

This rule detects createsan instance of a WMI class using tools like WMImplant or PowerLurk.

Malicious SQL Server Sqlcmd Utility Abuse for Privilege Escalation (via process_creation)

This rule detects uses sqlcmd utility to escalate privileges or introduce weaknesses.

Malicious User Application Credentials Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.

NTFS Hard Link Creation (via process_creation)

This rule detects create a hard link.

In-Memory Security Package (SSP) Added - Reg via Command (via process_creation)

This rule detects adds a reference in the registry to a malicious SSP (Security Support Provider). Note that this rule will not work with "in memory" SSP injection (Mimikatz).

Malicious Microsoft Defender Critical Security Components Disabled - PowerShell (via powershell)

This rule detects disable Defender security features in PowerShell.

Malicious Rubeus Kerberos Constrained Delegation Abuse - S4U2Proxy (via security)

This rule detects abuse Kerberos constrained delegation in order to escalate privileges.

Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)

This rule detects dump the LSASS process content using a renamed version of the Procdump tool.

Malicious Impacket SMBexec Service Creation - Registry (via registry_event)

This rule detects register the SMBexec service to estasblish persistence.

Malicious User Creation via Commandline (via process_creation)

This rule detects create a user via commandline.

Malicious Network Share Discovery And/or Connection via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.

Malicious RDP Tunneling (via rdp)

This rule detects uses RDP tunneling to redirect traffic to a C&C target.

Malicious Service Permissions Hijacked for Privileges Abuse - Reg via PowerShell (via powershell)

This rule detects modify the permissions of a service using native PowerShell commands in order to abuse its privileges. Note that it requires PowerShell 7 or higher.

Malicious Windows Native Backup Deletion (via process_creation)

This rule detects delete existing Windows native backup (only available on Windows Server).

Malicious Credentials (protected by DPAPI) Dump via Network Share (via security)

This rule detects attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.