Sigma detection rules, expert-reviewed

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

This rule detects the su binary being launched by a parent process that is not a common interactive shell or sudo, a privilege-escalation pattern tied to CVE-2026-31431 Copy Fail exploitation. Attackers invoke su from non-shell contexts to elevate to root after gaining initial code execution.

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

This rule detects wmic being spawned by an anomalous parent such as an Office application, browser or scripting host. Legitimate WMIC use rarely originates from these processes, so this parent-child relationship points to WMI being abused for execution or discovery following initial access.

Linux Bun Runtime Execution: bun_environment.js via node-parent process

Flags /node-launched /bun executions running bun_environment.js with an external runner release download URL.

Windows Setup16.EXE Execution Triggered by Custom .LST File

Flags Windows Setup16.EXE being invoked with ' -m ' from its system parent process, potentially tied to custom .lst-driven execution.

Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

Windows PingCastle Execution From Suspicious Parent Processes

Alerts on PingCastle (PingCastle.exe) being run with full scan/healthcheck arguments from potentially suspicious parent process locations.

Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

DarkGate-related Autoit3.exe execution with suspicious parent process (Windows)

Alerts on AutoIt3.exe execution when spawned from cmd.exe, KeyScramblerLogon.exe, or msiexec.exe, excluding common legitimate install paths.

Windows Diskshadow.exe Child Process Execution

Alerts when Diskshadow.exe is the parent process of a newly created process on Windows.

Linux: Shell Execution from /tmp by Parent Process

Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.

Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

Windows RDP client Mstsc.EXE launched from uncommon browser or email parent process

Alerts when mstsc.exe is spawned by a browser or Outlook, suggesting potential RDP access using a local .rdp file.

Windows: driverquery.exe Usage for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

Windows: Elevated PowerShell or CMD Spawned from Uncommon Parent Location

Alerts on elevated PowerShell/CMD executions whose parent process comes from uncommon Windows locations, indicating likely privilege escalation.