Sigma detection rules, expert-reviewed

Windows Application Logs: Detect WSUS deserialization exploitation via InvalidCastException indicators

Flags WSUS (EventID 7053) application log errors matching invalid cast/object data provider strings indicative of CVE-2025-59287 exploitation.

Windows Process Creation: Suspicious cmd.exe or PowerShell Child of WSUS (wsusservice.exe)

Alerts when WSUS/IIS service processes spawn cmd or PowerShell interpreters, indicating potential exploitation and post-exploitation activity.

Windows Registry Add WFP Filter Rules via BFE Parameters Path

Alerts on registry changes adding persistent WFP filters under the BFE policy persistent filter path via svchost.exe.

Windows SpeechRuntime.exe Child Process Creation

Alerts when SpeechRuntime.exe spawns a child process, highlighting potential abuse for lateral movement on Windows.

Windows process creation: child process spawned by winrshost.exe

Flags Windows process children of winrshost.exe that may indicate WinRS-driven remote command execution.

Windows Winrs.exe Local Command Execution via localhost/loopback

Alerts on Winrs.exe processes running locally by targeting localhost/loopback in /r or /remote.

AWS CloudTrail: TruffleHog User-Agent Execution Detected

Flags AWS CloudTrail events with user agent "TruffleHog" to surface potential secret-scanning or credential-harvesting activity.

Windows Suspicious File Write to Apache/Tomcat webapps ROOT (.jsp) by Web Server Processes

Alerts on .jsp writes into Apache/Tomcat webapps ROOT from dotnet/java/IIS worker processes on Windows.

Windows Process Creation: Commvault qlogin Argument Injection Indicators for Auth Bypass

Alerts on Windows command lines running Commvault qlogin with -localadmin-related markers consistent with argument injection.

Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop

Alerts on qoperation.exe commands that use -file to write a .jsp into a webroot path, consistent with a webshell drop.

Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password

Alert on qlogin.exe commands that authenticate as _+_PublicSharingUser_ using a GUID-formatted password.

Windows: ISATAP Router Address Set via Iphlpsvc Event ID 4100

Alerts on Windows events where an ISATAP router address is set via Microsoft-Windows-Iphlpsvc, excluding localhost/null values.

Windows SMB Server Share Connection Without Signing or Encryption

Alert on SMB share connections (IPC$/ADMIN$/C$) where signing and encryption are both reported as disabled.

Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\Roaming

Alerts on unauthorized access attempts to Signal Desktop’s config.json (key) and db.sqlite (messages) in the default Roaming path.

AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls

Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.