Sigma detection rules, expert-reviewed

Windows Process Creation: Crassus Privilege Escalation Discovery Tool Execution

Identifies execution of the Crassus Windows privilege escalation discovery tool via process metadata.

Windows: Stracciatella.exe Process Execution Identification (SharpPick behavior)

Alerts on Windows process creation for Stracciatella.exe using PE metadata and known SHA256 hashes.

Windows Process Creation: Certipy Tool Execution Based on PE and CLI Parameters

Flags Certipy.exe execution on Windows using PE metadata and Certipy-like AD CS command-line arguments.

Windows HackTool Certify Execution via Certify.exe and common AD abuse arguments

Identifies Windows processes running Certify.exe with AD certificate abuse-oriented command line arguments.

Windows: Unexpected Termination of Message Queuing (MSMQ) Service via SCM Event 7034

Flags Service Control Manager Event ID 7034 for unexpected termination of the Message Queuing (MSMQ) service.

Windows Service Control Manager: Termination of Security-Critical Services With Error

Alerts on error-terminated Windows security and infrastructure services from Service Control Manager event 7023.

Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation

Alerts when mqsvc.exe spawns common scripting/utility executables often used for unauthorized execution.

Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r

Alerts on Linux executions of php -r inline code that references fsockopen, consistent with outbound reverse-shell style socket creation.

Linux Perl Reverse Shell Execution via Perl -e and Socket/exec Patterns

Detects perl -e one-liners on Linux that include Perl Socket::INET reverse-shell code patterns and exec/connect logic.

Linux netcat/ncat Execution with -e and Shell Invocation

Alerts on Linux executions of nc/ncat using -e that reference common shells, indicating potential reverse-shell setup.

Okta Failed Login with Password-Like AlternateID Value

Alerts on Okta login_failed events with alternateId values that may contain password data, risking credential exposure in logs.

Possible ICO C2 File Downloads via Proxy: Compromised 3CXDesktopApp

Flags proxy requests for 3CXDesktopApp icon storage URIs ending in .ico, indicating potential malicious payload downloads.

Proxy Beaconing to 3CX-Related Domains Indicating Possible Compromise

Flags proxy requests to 3CX-related domains that may indicate C2 beaconing behavior.

Windows: Flag 3CXDesktopApp updater fetching a known compromised update URL

Alerts on 3CXDesktopApp updater.exe launched with update arguments pointing to a known compromised HTTP update path.

Windows Process Creation: Suspicious Child Executables Spawned by 3CXDesktopApp.exe

Alerts on suspicious execution utilities spawned by 3CXDesktopApp.exe via Windows process creation events.