Sigma detection rules, expert-reviewed

Windows PowerShell Module Execution Matches Known Offensive PoshModule Script Names

Alerts on Windows PowerShell module executions where the script context matches known offensive PowerShell script/module names.

Windows: Detect Aruba Netsvc DLL Search Order Hijacking via arubanetsvc.exe Loaded DLLs

Flags arubanetsvc.exe loading targeted DLLs outside standard system paths, suggesting possible DLL search order hijacking.

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Detects rundll32 executions that reference DLLs stored in Alternate Data Streams via ADS-style paths.

Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact

Alerts on creation of PsExec key files in C:\Windows\PSEXEC-*.key, indicating remote execution activity.

Windows Process Creation: svchost DHCPServer RCE Exploitation Attempt

Alerts on svchost.exe running as Network Service with -k DHCPServer, suggesting a potential pre-auth Windows RCE attempt.

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Alerts on PowerShell module payloads containing commandlet/function names from known malicious exploitation and post-exploitation frameworks.

Detect CentOS Web Panel POST login reverse-shell RCE attempts (CVE-2022-44877)

Alert on POST requests to CentOS Web Panel login that contain command-execution and reverse-shell style query parameters.

Windows: driverquery.exe Usage for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Flags successful Windows SMB (LogonType 3) logons from non-private, non-local source IP addresses.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

Windows Firewall Rules Deleted (Windows Defender Firewall) via Firewall-as Events

Alerts on Windows Defender Firewall configurations where all rules are deleted (Event 2033/2059), signaling potential defense impairment.

Windows DNS Client: DNS query for anonfiles.com domain

Alerts when Windows DNS client logs show a DNS query containing .anonfiles.com.

Windows Registry: Excel Options Run Entry Point for XLL Add-in Persistence

Flags registry writes that reference an Excel XLL add-in via a '/R ' command under Excel Options.

Windows Registry: DisableRestrictedAdmin Value Tampering to Change Restricted Admin Mode

Flags registry modifications to DisableRestrictedAdmin that change Restricted Admin mode settings.

Windows Process Creation: Registry Tampering of DisableRestrictedAdmin in Lsa Key

Alerts when a process command line references LSA DisableRestrictedAdmin to change RestrictedAdmin behavior via the registry.