Sigma detection rules, expert-reviewed

Zeek DNS: Detect NKN Seed Domain Queries

Alerts on Zeek DNS queries containing "seed" and ending with .nkn.org, a pattern consistent with NKN network activity.

Windows File Access to Browser Credential Stores by Uncommon Processes

Detects suspicious process access to Firefox/Chromium credential store files on Windows, excluding common system and known benign paths.

Windows Security: Outgoing Logon (LogonType 9) Using New Credentials (4624)

Flags Windows 4624 LogonType 9 events where new credentials are used for authentication.

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows fsutil.exe Drive Enumeration via Process Execution

Flags fsutil.exe process launches with command lines referencing connected drive enumeration.

Windows PowerShell: Suspicious Process Discovery Using Get-Process

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

Windows: Executable Creates Executable via File Creation Events

Flags .exe-to-.exe executable drops on Windows when a running executable creates another .exe, with exclusions for common system/update paths.

Windows BITS Job Creation Triggered by PowerShell

Flags new BITS job creation on Windows when initiated by PowerShell (Event ID 3).

Windows BITS job created by bitsadmin.exe (BITS Client EventID 3)

Alerts on new BITS job creation when bitsadmin.exe triggers it (BITS-Client EventID 3).

Windows Firewall Settings Change Events (Windows Firewall/Defender Firewall-AS)

Alert on Windows Firewall/Defender firewall setting changes using Events 2002, 2003, 2008, 2082, and 2083.

Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)

Flags Windows where Windows Defender Firewall is reset to default settings via firewall-as events.

Windows Defender Firewall Service Failed to Load Group Policy (Event ID 2009)

Alert on Event ID 2009 when the Windows Defender Firewall service cannot load Group Policy.