Sigma detection rules, expert-reviewed

Windows Process Creation: Command-Line Kerberos Coercion Signature via DNS SPN Spoofing

Alerts on Windows command lines containing 'UWhRCA' and 'BAAAA', a signature tied to Kerberos coercion via spoofed credential targeting.

Windows DNS Query with Kerberos Coercion Signature via DNS Object SPN Spoofing

Alerts on Windows DNS queries containing a base64-like credential target signature linked to Kerberos coercion via DNS spoofing.

Windows AD DNS Record Modification Indicators for Kerberos Coercion via SPN DNS Spoofing

Alerts on AD MicrosoftDNS DNS node changes whose DN contains a CREDENTIAL_TARGET_INFORMATION base64 marker tied to Kerberos coercion.

Zeek DNS detects base64 credential target pattern consistent with Kerberos DNS object spoofing

Alert on Zeek DNS queries containing the base64 Kerberos coercion signature pattern tied to CREDENTIAL_TARGET_INFORMATION.

Windows DLL Load Trusted Path Bypass via Spoofed Directory Paths with Extra Space

Flags Windows DLL loads from spoofed "C:\Windows \\System32"-style paths with an extra space to indicate trusted-path bypass attempts.

Linux: Suspicious curl/wget Download to /tmp or /dev/shm Followed by sh -c Execution

Flags curl/wget retrieving content into /tmp or /dev/shm followed by immediate sh -c execution on Linux.

Windows Process Creation: Possible CVE-2025-33053 WebDAV RCE via utility search-order manipulation

Flags suspicious child execution from WebDAV/UNC paths initiated by iediagcmd.exe or CustomShellHost.exe, consistent with CVE-2025-33053 exploitation.

Windows Process Access: Suspicious WebDAV target execution via iediagcmd.exe or CustomShellHost.exe (CVE-2025-33053)

Alerts when iediagcmd.exe or CustomShellHost.exe access WebDAV-hosted executables consistent with a potential RCE attempt.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

Windows Process Creation: SharpSuccessor.exe Execution with Impersonation Parameters

Alerts on SharpSuccessor.exe command-line patterns indicative of Windows privilege escalation attempts.

RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.

Windows Event Log: MSSQLSERVER$AUDIT alerts on DROP/ TRUNCATE destructive SQL statements

Flags audited MSSQL transactions that include DROP TABLE, DROP DATABASE, or TRUNCATE TABLE.

Windows Process Loaded BitsProxy.dll via Uncommon Image

Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.

Windows DNS Queries to Malware Hosting and URL Shortener Domains

Alert on Windows DNS queries to domains tied to URL shorteners and malware hosting services.

Linux mknod Syscall Used to Create Special Files

Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.