Sigma detection rules, expert-reviewed

Windows Service Terminated With Error (Service Control Manager Event 7023)

Alerts on Windows services terminated with an error as reported by the Service Control Manager (EventID 7023).

Linux Bash Launched in Interactive Mode (-i)

Alerts when /bash is executed with the interactive flag (-i) on Linux.

Windows Registry Changes for Outlook Task/Note Reminder Trigger

Flags Windows registry writes under Outlook task/note keys consistent with an Outlook reminder being triggered.

Suspicious Proxy Requests to IPFS URLs Containing Email Address

Alerts when proxy request URIs target IPFS and include an email address.

Windows AMSI.DLL Image Load by Uncommon Process Paths

Alerts when Amsi.dll is loaded by processes outside common Windows binaries and directories.

Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr

Flags 7-Zip (7z/7za/7zr) command lines that include -p with x extraction and -o output, indicating password-protected archive extraction.

Linux Package Removal via yum, apt, dpkg, or rpm Commands

Detects package uninstall activity on Linux via yum, apt/apt-get, dpkg, or rpm based on command-line removal flags.

Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)

Identifies sc.exe executions that include 'stop' to stop Windows services based on process creation and command line.

Windows PowerShell Stop-Service Used to Stop a Service

Flags PowerShell executions that include the Stop-Service cmdlet to stop a Windows service.

Windows: Service stop activity via net.exe command line

Flags Windows processes running net.exe/net1.exe with a command line containing ' stop ' to stop a service.

Windows New Service Creation via sc.exe

Flags sc.exe service creation commands containing create and binPath on Windows, excluding Dropbox-launched cases.

PowerShell Creates Windows Service via New-Service and -BinaryPathName

Flags PowerShell command lines that use New-Service with -BinaryPathName to create a Windows service.

macOS: Guest account enabled via sysadminctl

Flags sysadminctl command lines that appear to activate the macOS guest account.

Windows nltest.exe Execution for Network Information Discovery

Flags execution of nltest.exe (including nltestrk.exe via OriginalFileName) used for network and domain information discovery.

GitHub Audit Log: Self-Hosted Runner Configuration Changes

Alerts on GitHub audit log events indicating self-hosted runner registration and runner group configuration changes.