Sigma detection rules, expert-reviewed

Windows: Delete Backup or System State Backups via wbadmin.exe

Flags wbadmin.exe command lines that delete backup or system state backups, potentially impacting recovery.

Windows wbadmin.exe Deletes All Backup Copies (keepVersions:0)

Flags wbadmin.exe executions that delete all backups/system state backups using keepVersions:0.

Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags

Flags AdFind.exe processes that look like Active Directory discovery via password policy and object enumeration options.

Windows CMD dir /S File and Subfolder Enumeration

Flags cmd.exe executions using dir with the /S flag to enumerate files in a directory and all subdirectories.

PowerShell Script Block Collection of Browser Bookmarks via Get-ChildItem

Detects PowerShell Get-ChildItem activity used to recursively enumerate browser bookmarks from a target path.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

PowerShell Local Group Discovery via Get-LocalGroup and Get-LocalGroupMember (Windows)

Identifies PowerShell commands enumerating local groups and their members, indicating potential local permission discovery.

Webserver JNDI-Exploit-Kit Exploitation Indicators via Known Payload Paths

Flags webserver requests whose URL paths match known JNDI-Exploit-Kit exploit, deserialization, and memshell pattern strings.

Windows Process Discovery via tasklist Command Execution

Alerts on Windows executions of tasklist.exe used for running process discovery.

Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution

Flags Windows execution of Nmap/Zenmap (nmap.exe or zennmap.exe) used for remote service discovery.

Windows Net.exe Network Connections Discovery via Use Sessions Query

Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Alerts when SharpView.exe runs with command-line indicators of AD and network discovery/enumeration activity.

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

Detects PowerShell usage of Get-NetTCPConnection to enumerate TCP network connections.