Sigma detection rules, expert-reviewed

Windows Process Command Line: Accidental Cobalt Strike Commands in cmd.exe

Flags cmd.exe executions whose command lines include known Cobalt Strike command terms.

Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Flags cmd.exe with /r from external media launching msiexec.exe /q that includes an HTTP/HTTPS payload URL.

Windows: Raspberry Robin Command Execution via fodhelper.exe and rundll32/regsvr32

Flags Windows process-spawn chains where fodhelper.exe runs rundll32/regsvr32 with Raspberry Robin-style command-line patterns.

Windows Process Creation: Suspicious Child Processes Spawned by regsvr32.exe

Alerts when regsvr32.exe spawns suspicious child processes like PowerShell, mshta, or scripting utilities.

Windows: Registry Set by Rundll32 for Screen Saver Execution via SCRNSAVE.EXE

Flags Windows registry sets where Rundll32 points SCRNSAVE.EXE to a .scr file.

Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc

Detects rundll32.exe launching davclnt.dll DavSetCookie with HTTP and spoolss/srvsvc pipe parameters associated with NTLM coercion.

Linux: Detects Nimbuspwn-related exploit strings targeting CVE-2022-29799/CVE-2022-27800

Detects Linux keyword patterns suggesting Nimbuspwn-style traversal attempts via networkd-dispatcher error handling.

Windows Registry: Service configured with image path in suspicious public/temp folders

Detects Windows service ImagePath pointing to Users\Public, Perflogs, ADMIN$, or Temp based on registry_set events.

Windows: PrintBrm.exe ZIP extraction or creation via command-line parameters

Flags PrintBrm.exe executions that include '-f' and '.zip', consistent with ZIP creation or extraction behavior.

Windows JScript Compiler (jsc.exe) Process Execution

Identifies execution of jsc.exe (JScript Compiler) from Windows process creation logs.

Windows Service ImagePath Set to Non-Admin Controlled Directory

Alerts when a Windows service’s ImagePath is changed to a binary path under AppData or ProgramData.

Windows Process Creation: gpresult.exe Group Policy (RSoP) Discovery (/z /v)

Flags process executions of gpresult.exe that request RSoP details using /z and /v on Windows.

Windows svchost.exe RDP (3389) Connections to HTTP/HTTPS Ports 80 or 443

Alerts when svchost.exe initiates from TCP 3389 to destination ports 80 or 443, consistent with possible RDP tunneling over web ports.

Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs

Detects suspicious ngrok usage that forwards to the local RDP port using Windows TerminalServices-LocalSessionManager EventID 21.

Windows rundll32.exe executing InstallScreenSaver via desk.cpl SCR File

Detects rundll32.exe launches with InstallScreenSaver behavior via desk.cpl, a screensaver execution technique.