Sigma detection rules, expert-reviewed

SAP NetViewer Webshell Command Execution via JSP cmd Parameter

Alerts on SAP NetViewer JSP requests likely used as webshells to execute system commands via cmd-style query parameters.

Suspicious cmd.exe execution from w3wp.exe tied to CentreStack portal.config (Windows process creation)

Alerts when w3wp.exe launches cmd.exe and its command line references \portal\portal.config, suggesting possible IIS app exploitation.

Windows Registry: MiniNt Key Added to Disable Security Event Logging on Reboot

Flags registry set activity that adds the MiniNt key, which stops Windows Event Log from writing events after a reboot.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows Registry RunMRU Tampering with HTTP/HTTPS and Script Execution Indicators

Alerts on Windows RunMRU registry changes containing HTTP/HTTPS URLs plus captcha/automation or command execution indicators.

Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit

Alerts when explorer.exe launches a .lnk and the command line contains suspicious whitespace padding used to hide extended arguments.

Suspicious autorun registry modification via WMI wmic spawning reg.exe on Windows

Flags WMIC-driven reg.exe commands that add Run key autorun entries, especially when pointing to suspicious temp/user locations.

Windows curl.exe SOCKS Proxy and .onion Command-Line Execution

Alerts on Windows curl.exe being run with Tor SOCKS proxy URIs and .onion targets in the command line.

Windows Scheduled Task Creation Using System Process Names

Flags schtasks.exe /create commands whose arguments reference common Windows system process names.

Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Alerts when mmc.exe runs with command lines containing RLO-style reversed filename patterns ending in .msc.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows file creation of executable/script files in \Users\Public

Alerts on Windows file creation in \Users\Public\ with potentially malicious script/binary extensions.

Linux: Shell spawned by rsync without -e flag in command line

Flags rsync/rsyncd spawning a shell when rsync lacks the expected " -e " command-line flag.

Windows Registry EventLog ChannelAccess SDDL Tampering Detection

Detects registry changes to Windows Event Log ChannelAccess SDDL, which can limit event log visibility or control.

M365 Audit: Successful Intune Company Portal login via Cmsi

Flags successful Company Portal (Intune) logins via Cmsi audit events that may indicate Conditional Access bypass attempts.