Sigma detection rules, expert-reviewed

Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

Windows: TacticalRMM Agent Installed with API/Auth Flags Pointing to Remote RMM Server

Alerts when TacticalRMM agent starts with --api/--auth and identity flags consistent with connecting to a configured remote RMM server.

Windows PowerShell Obfuscated COM MSI Installation via WindowsInstaller.Installer

PowerShell spawning that uses WindowsInstaller.Installer COM with obfuscated strings to call InstallProduct and suppress UI.

Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)

Flags auditd syslog syscall actions that clear or suppress kernel ring buffer (dmesg) logs.

Windows vshadow.exe Proxy Execution via -exec Script/Command

Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.

Linux: Disable ASLR via personality syscall or sysctl/randomize_va_space changes

Flags Linux events where ASLR is disabled using the personality syscall or sysctl setting kernel.randomize_va_space=0.

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Alerts on PowerShell runs of New-ADServiceAccount to create a delegated service account with -CreateDelegatedServiceAccount and -path.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.

Linux auditd: Detect writes to /proc/sysrq-trigger or sysrq-related config for Magic SysRq abuse

Alerts on auditd PATH events referencing /sysrq or /sysrq-trigger, indicating possible Linux Magic SysRq abuse.

Windows reg.exe Registry Save/Export of Third-Party Credential Paths

Alerts on reg.exe save/export commands targeting registry keys tied to third-party credential data.

Windows: Deno writes files from remote HTTPS content into AppData

Alerts when Deno writes to user AppData while using remote HTTPS download-style paths.

Windows File Access to Browser Credential Storage by Non-Browser Processes

Flags non-browser processes reading common browser credential storage files on Windows, indicating potential credential theft.

Windows Security: Kerberos TGT requests with PreAuthType=0 and RC4-HMAC (0x17) to krbtgt

Alerts on krbtgt TGT requests using RC4-HMAC with pre-authentication disabled (PreAuthType=0), consistent with AS-REP roasting attempts.

Zeek HTTP: Suspicious User-Agent Containing "katz-ontop"

Alerts on Zeek HTTP sessions whose User-Agent includes "katz-ontop", a potential malware indicator.