Sigma detection rules, expert-reviewed

AWS CloudTrail: S3 Browser creating IAM LoginProfiles after querying GetLoginProfile

Flags CloudTrail IAM GetLoginProfile and CreateLoginProfile activity initiated by an S3 Browser user agent.

Windows LiveKD Kernel Memory Dump Attempt via "-m" Flag

Flags LiveKD executions with the "-m" option that may trigger kernel memory dumping on Windows.

Windows LiveKD Driver File Creation by Uncommon Process Image

Alerts when LiveKdD.SYS is created by a process other than livekd.exe/livek64.exe on Windows.

Windows: LiveKD kernel memory dump file creation (livekd.dmp)

Flags creation of C:\Windows\livekd.dmp, a default LiveKD kernel memory dump file name.

Proxy Web Requests Matching Devil Bait C2 HTTP Parameters

Identifies proxy HTTP GET requests to /cross.php containing op, dt, and uid query parameters consistent with potential C2 traffic.

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Flags wscript.exe/cscript.exe launching files named with uncommon non-script extensions via command-line content.

Suspicious Child Process of GoogleUpdate.exe on Windows

Alerts when GoogleUpdate.exe spawns an unexpected child process on Windows, using parent/child image telemetry and allowlisting common Google updaters.

Windows Process Creation: certutil.exe Encodes Files to Base64 in Suspicious Paths

Alert on certutil.exe running with -encode when the command line references files under suspicious directories.

Windows: certutil.exe Encodes Files to Base64 Using -encode With Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators

Flags Windows command lines that copy SolidPDFCreator.dll and set a Run registry key for auto-execution.

Windows: GoogleUpdate.exe Self-Spawn From Uncommon Path

Alerts when GoogleUpdate.exe launches another GoogleUpdate.exe from an unusual directory.

Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

Uncommon Windows Processes Writing .txt/.xml in AppData\Roaming\Microsoft

Flags creation of .txt/.xml files in AppData\Roaming\Microsoft by schtasks.exe, wscript.exe, or mshta.exe.

Potential C2 HTTP Traffic via Goofy Guineapig User-Agent to static.tcplog.com (Proxy Logs)

Flags proxy HTTP requests with a specific Chrome-like User-Agent to static.tcplog.com, consistent with potential C2 traffic.

Windows Process Command Line Matching Goofy-Guineapig Backdoor Command Fragment

Alerts on Windows process command lines containing a specific non-interactive choice command often used in automation.