Every published rule

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

Windows regini.exe Execution Leading to Registry Key Changes

Alerts on Windows executions of regini.exe that can import registry changes from text files.

Windows net.exe Unmount Share (/delete) Execution

Alerts on net.exe/net1.exe commands that include "share" and "/delete", indicating share unmount/removal on Windows.

macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands

Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.

Linux Local Account Enumeration via lastlog, /etc/* file reads, id, and lsof -u

Flags Linux process activity consistent with enumerating local system accounts using /etc account data and related tools.

Linux Password Policy Discovery via chage and passwd Commands

Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.

macOS Local User Account Creation via dscl or sysadminctl

Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.

Linux at/atd Process Execution via /at or /atd

Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.

Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.

Linux process discovery via common process listing and monitoring tools

Flags Linux execution of common tools used to enumerate running processes.

Windows findstr.exe Subfolder and Case-Insensitive Search Flags

Alerts on findstr.exe executions that include both -s (subfolders) and -i (case-insensitive) flags.

Linux: Process executing update-ca-certificates or update-ca-trust

Detects Linux executions of update-ca-certificates or update-ca-trust that install new trusted root certificates.

Windows Process Proxying: explorer.exe Spawned from cmd.exe or PowerShell

Flags cmd.exe/powershell.exe launching explorer.exe, indicating possible proxy-based execution on Windows.

Windows VirtualBox Driver Registration or VM Startup via Process Command Line

Alerts on Windows processes whose command lines reference VirtualBox driver registration or VM start/control actions.

Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse

Alerts on MicrosoftAccountTokenProvider.dll loads on Windows, with process-based exclusions, as a signal for potential Azure Browser SSO token activity.

PowerShell Classic bXOR Operator Usage in Command Line

Identifies PowerShell classic executions from ConsoleHost using the -bxor operator in the command line.

Linux Remote File Copy via scp, rsync, or sftp

Flags Linux command lines using scp/rsync/sftp with remote-target style arguments containing “@” and “:”.

Linux Process Sets HTTP/HTTPS Proxy Environment Variables

Flags Linux process command lines that set http_proxy and https_proxy values, indicating proxy configuration.