Sigma detection rules, expert-reviewed

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

DNS Queries for Monero Mining Pool Domains

Alerts on DNS queries to known Monero mining pool domains that may indicate cryptomining activity.

Windows: CertOC.exe certificate utility loading a DLL via -LoadDLL

Flags CertOC.exe launching with -LoadDLL to load a specified DLL on Windows.

Windows Process Execution via WorkFolders.exe Launching control.exe

Alerts when WorkFolders.exe spawns a non-standard control.exe instance on Windows.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.

PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)

Flags PowerShell script block text indicating WindowStyle set to Hidden, suggesting concealed execution.

PowerShell: Set-ExecutionPolicy to Unrestricted or Bypass

Alerts when PowerShell sets execution policy to Unrestricted or bypass, indicating weakened script execution controls.

Windows Registry: Clearing RDP Client Connection History via MRU and Server Keys Deletion

Flags registry deletions that remove Windows RDP client connection history from Terminal Server Client MRU and Servers keys.

Linux Network Connection to /bin/bash via Reverse Shell Pattern

Alerts on /bin/bash network connections to non-local destination IPs, consistent with reverse shell behavior.

Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

Linux dd Command Overwrite or Deletion via of= and input redirection

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.

Linux Clipboard Data Collection via xclip -sel clip -o

Alerts on Linux processes running xclip to output clipboard content using -sel clip -o.

Linux Syslog Clearing or Removal Using System Utilities

Alert on Linux commands that clear, delete, truncate, or redirect /var/log/syslog or rotate/vacuum journald logs.

Linux Cron Directory File Creation via File Events

Flags new Linux cron-related files created under standard cron directories, excluding a few known benign paths.

GCP Cloud SQL Database Modified or Deleted via Audit API

Alerts on Cloud SQL instance create/delete and user update/delete events in GCP audit logs.