Sigma detection rules, expert-reviewed

AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock

Alerts when CloudTrail shows S3 Block Public Access settings being weakened (set to false) in PutBucketPublicAccessBlock with Success.

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Detects execution of GoldenDMSA.exe with command-line indicators consistent with wordlist/bruteforce directory account manipulation.

Windows Security: Kerberos 4771 Pre-Authentication Failures for Machine Account Password Guessing

Triggers on Kerberos pre-authentication failures (4771) for machine accounts using status codes 0x19/0x18.

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Alerts on registry modifications under Security Center AV Provider keys that update antivirus product fields like ProductEXE and DisplayName.

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

Detects Defendnot persistence by alerting on scheduled task create/update activity for \defendnot with --from-autorun.

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Alerts when reg.exe modifies Windows policy settings that disable or restrict internal tools and Explorer/System behavior.

Linux: System Shell Spawned by Celery Worker Python Process

Flags Linux instances where a Celery worker’s Python process spawns a system shell interpreter.

Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

Flags registry updates that enable per-application Microsoft Defender Firewall exceptions via AuthorizedApplications\List.

Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)

Alerts when DoNotAllowExceptions is set to 0 in the Defender Firewall policy registry path, re-enabling firewall exceptions.

PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)

Flags PowerShell command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke them via array index.

Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index

Flags obfuscated PowerShell scripts that enumerate ExportedCommands and invoke them indirectly using array indexing.

Windows: Detect Defendnot HackTool Process Execution

Alerts on Windows process executions referencing Defendnot, including its URL and known IMPHASH values.

Uncommon Child Process Spawned by XBootMgrSleep.exe (Windows Performance Toolkit)

Alerts when XBootMgrSleep.exe launches an unexpected child process on Windows, indicating potential delayed execution abuse.

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.