Sigma detection rules, expert-reviewed

PowerShell Get-ADUser Enumeration Using UserAccountControl DONT_REQ_PREAUTH Flag

Flags Get-ADUser PowerShell scripts enumerating accounts by UserAccountControl DONT_REQ_PREAUTH (4194304).

Windows PowerShell: Suspicious Get-ADDBAccount access to ntds.dit via BootKey and DatabasePath

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

Windows Remote Thread Creation Targeting Uncommon System Image Processes

Alert on Windows remote thread creation events targeting a predefined list of uncommon processes by image path.

Windows schtasks.exe Create Executes File from AppData\Local

Alerts on schtasks.exe creating tasks that run payloads from C:\Users\<user>\AppData\Local.

Linux Process Creation: Shell Command Piped Into Another Shell

Flags Linux processes that start with sh/bash -c and pipe execution into a subsequent shell.

Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image

Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.

Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping

Alerts on Windows command lines using for/foreach loops that also run nslookup or ping, consistent with host scanning.

Windows HackTool Process Patterns for CrackMapExec LSASS Dumping

Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.

Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling

Detects suspicious Windows processes that reference NTDS.DIT/SYSTEM hive dumping or staging via common NTDS tooling and scripts.

Windows NTDS Exfiltration File Creation by NTDS Export Filename Patterns

Alerts on Windows file creates using common NTDS-DIT dump/exfiltration filename suffixes like \All.cab and .ntds.cleartext.

Windows Process Access Indicates Potential Shellcode Injection via LSASS

Alerts on high-privilege process access from wmiprvse.exe to lsass.exe consistent with potential shellcode injection behavior.

Windows: Executable Creates Executable via File Creation Events

Flags .exe-to-.exe executable drops on Windows when a running executable creates another .exe, with exclusions for common system/update paths.

Windows Process Creation: OfflineScannerShell.exe mpclient.dll DLL Sideloading Risk

Detects OfflineScannerShell.exe launched with an unexpected current directory that could enable mpclient.dll sideloading.

Windows Process Creation: Replace.exe with -a argument

Detects Replace.exe executions that include the -a argument, which may be used for file replacement.

Windows Suspicious UltraVNC Command Line With Auto-Reconnect Flags

Alerts on UltraVNC execution using -autoreconnect with -connect and -id in the Windows command line.