Sigma detection rules, expert-reviewed

Windows File Events Indicative of SlashAndGrab ScreenConnect Post-Exploitation

Alerts on Windows file activity writing known SlashAndGrab-related ScreenConnect artifact paths and executables.

Windows DNS Queries to Known DPRK C2 Domains

Flags Windows DNS queries for specific DPRK-attributed C2 domain names.

Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns

Flags proxy HTTP requests whose URI, method, User-Agent, host, and cookie fragments match known Cobalt Strike malleable profile patterns.

FortiOS sslvpnd CVE-2022-42475 Exploitation Indicator Keyword Matching

Flags FortiOS sslvpnd activity containing known CVE-2022-42475 artifact paths from file-related events.

Windows iexpress.exe Creates Self-Extracting Binaries Using SED Files From Suspicious Paths

Flags suspicious use of Windows iexpress.exe to create self-extracting packages via SED directives from uncommon/temp paths.

Windows SharpMove (.NET) Execution via SharpMove.exe and Action Command-Line Flags

Alerts on SharpMove.exe process execution with command-line actions for DCOM, WMI VBS, and task scheduler.

Windows EDRSilencer Execution via Filtering Platform FilterName Change

Detects Filtering Platform custom outbound filter additions associated with potential EDRSilencer execution on Windows.

Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments

Flags SOAPHound execution on Windows by detecting command-line arguments used for Active Directory data collection.

Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

Windows process creation matching specific Peach Sandstorm command-line indicator

Alerts on Windows process creations whose command line contains a specific suspicious substring.

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Flags Windows processes that look like renamed PingCastle executables using PE original file names and PingCastle scanner/healthcheck arguments.

Windows PingCastle Execution From Suspicious Parent Processes

Alerts on PingCastle (PingCastle.exe) being run with full scan/healthcheck arguments from potentially suspicious parent process locations.

Windows .cpl Image Loads from Uncommon Paths Indicating Control Panel Abuse

Alerts on Windows loading of .cpl control panel items from uncommon paths instead of standard system directories.

Windows WFP 5157: Connection Blocked for EDR Agent Binaries

Flags WFP blocked connections (EventID 5157) when an EDR/security agent binary is the blocked application.

Windows forfiles.exe Spawned cmd.exe from Non-System Location

Alerts on forfiles.exe running outside system paths and spawning cmd.exe with a forfiles-encoded command pattern.