Sigma detection rules, expert-reviewed

Windows file events matching SNAKE-related installer filename indicators

Flags Windows file events with target filenames ending in common SNAKE installer indicators like jpsetup.exe and jpinst.exe.

Windows PowerShell Module File Creation via PowerShell Processes

Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.

Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe

Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.

Windows PowerShell Import-Module Cmdlet Execution

Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.

Windows: File Creation of NTDS.DIT (Active Directory Database)

Flags creation of an ntds.dit file on Windows, an Active Directory database artifact often associated with credential access.

Windows Non-Browser Process Network Connection to api.notion.com

Alerts when a non-browser Windows process connects to api.notion.com, excluding common browsers and the Notion desktop app.

Windows Security: Security-Enabled Global Group Deletion (Event ID 4730/634)

Alerts on Windows Security audit events indicating a security-enabled global group was deleted.

Windows Security Log: Member Removed from Security-Enabled Global Group

Flags Windows Security Log events showing a member was removed from a security-enabled global group.

Windows Security: Member Added to Security-Enabled Global Group

Alerts when Windows logs show a user was added to a security-enabled global group via Event ID 4728 or 632.

Windows mstsc.exe launched with local .rdp file argument

Alerts on mstsc.exe executions that reference local .rdp files via the command line.

Windows winget AppInstaller admin_settings registry modification via winget.exe

Detects winget.exe-driven changes to AppInstaller admin_settings in the registry under LocalState\admin_settings.

Windows Service Terminated With Error (Service Control Manager Event 7023)

Alerts on Windows services terminated with an error as reported by the Service Control Manager (EventID 7023).

Linux Bash Launched in Interactive Mode (-i)

Alerts when /bash is executed with the interactive flag (-i) on Linux.

Windows Registry Changes for Outlook Task/Note Reminder Trigger

Flags Windows registry writes under Outlook task/note keys consistent with an Outlook reminder being triggered.

Suspicious Proxy Requests to IPFS URLs Containing Email Address

Alerts when proxy request URIs target IPFS and include an email address.