Every published rule

Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

Windows: Network connections initiated to api.mega.co.nz or mega.nz

Identifies initiated Windows outbound connections to api.mega.co.nz/mega.nz for potential file-transfer staging.

Windows sc.exe Service Query Execution via Process Creation

Flags sc.exe executions with command lines containing " query", consistent with Windows service information discovery.

Linux auditd: getcap scanning for setuid/setgid-capable files under root

Flags getcap command-line usage scanning / for Linux capability-bearing files via auditd.

macOS: Process commands with trailing space in filename to evade matching

Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Linux dd Command Overwrite or Deletion via of= and input redirection

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.

Linux Clipboard Data Collection via xclip -sel clip -o

Alerts on Linux processes running xclip to output clipboard content using -sel clip -o.

Linux Cron Directory File Creation via File Events

Flags new Linux cron-related files created under standard cron directories, excluding a few known benign paths.

OneLogin: Detect API user account lock or suspension events

Flags OneLogin API events indicating a user account was locked or suspended.

OneLogin: User Assumes Another Account via Event Type 3

Alerts on OneLogin events indicating a user assumed another user account via event_type_id 3.

AWS Glue Dev Endpoint Lifecycle Events (Create/Update/Delete) via CloudTrail

Flags Glue Create/Update/DeleteDevEndpoint API activity in CloudTrail that may indicate suspicious development endpoint management.

Linux xclip Clipboard Image Collection via Image MIME Types

Flags xclip usage that outputs image/* data from the clipboard on Linux.

Clipboard Data Collection via xclip (auditd Linux EXECVE)

Alerts on xclip command lines that request clipboard/clip selection output (-o) on Linux systems monitored by auditd.

AWS CloudTrail: Lambda Function Updated with New Layer Attached

Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.

Linux Import Tool Image Capture via execve with -window root and .png/.jpg output

Flags Linux ImageMagick import executions likely used for desktop screenshot capture to PNG/JPG outputs or root window.

Linux screen capture using xwd saving a .xwd file

Flags xwd screen capture executions that write captured output to a .xwd file on Linux.

Okta Policy Lifecycle Updated or Deleted

Flags Okta events indicating a policy was updated or deleted.

Linux steghide steganography: Extract hidden files from JPG/PNG

Detects steghide extracting embedded data from image files (.jpg/.png) on Linux.