Sigma detection rules, expert-reviewed

Windows Process Creation: SharpSuccessor.exe Execution with Impersonation Parameters

Alerts on SharpSuccessor.exe command-line patterns indicative of Windows privilege escalation attempts.

RegAsm.exe Process Execution Missing Command-Line and Assembly Path (Windows)

Alert on RegAsm.exe process creation when the command line lacks typical Regasm flags or file parameters.

Windows Event Log: MSSQLSERVER$AUDIT alerts on DROP/ TRUNCATE destructive SQL statements

Flags audited MSSQL transactions that include DROP TABLE, DROP DATABASE, or TRUNCATE TABLE.

Windows Process Loaded BitsProxy.dll via Uncommon Image

Alert on image loads of BitsProxy.dll by processes outside an allowlist of common Windows BITS-related executables.

Windows DNS Queries to Malware Hosting and URL Shortener Domains

Alert on Windows DNS queries to domains tied to URL shorteners and malware hosting services.

Linux mknod Syscall Used to Create Special Files

Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.

Linux sysinfo Syscall for System Information Discovery

Detects auditd-reported sysinfo syscalls on Linux that can indicate system fingerprinting or reconnaissance.

Windows: TacticalRMM Agent Installed with API/Auth Flags Pointing to Remote RMM Server

Alerts when TacticalRMM agent starts with --api/--auth and identity flags consistent with connecting to a configured remote RMM server.

Windows PowerShell Obfuscated COM MSI Installation via WindowsInstaller.Installer

PowerShell spawning that uses WindowsInstaller.Installer COM with obfuscated strings to call InstallProduct and suppress UI.

Linux auditd: Clear kernel ring buffer via syslog syscall (action 5/4/6)

Flags auditd syslog syscall actions that clear or suppress kernel ring buffer (dmesg) logs.

Windows vshadow.exe Proxy Execution via -exec Script/Command

Alerts when vshadow.exe is run with -exec, which can proxy execution of a script or command after shadow copy creation.

Linux: Disable ASLR via personality syscall or sysctl/randomize_va_space changes

Flags Linux events where ASLR is disabled using the personality syscall or sysctl setting kernel.randomize_va_space=0.

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Alerts on PowerShell runs of New-ADServiceAccount to create a delegated service account with -CreateDelegatedServiceAccount and -path.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.