Sigma detection rules, expert-reviewed

Windows Registry: Flag Print Driver Registry Paths for QMS 810 and mimikatz

Detects registry TargetObject entries containing QMS 810 or mimikatz-related printer driver names under Windows print environments.

Windows Print Spooler Exploitation Indicators: UNIDRV.DLL and mimispool Driver Loads (Event ID 316)

Flags Windows Print Spooler Event ID 316 entries containing UNIDRV/mimispool-related keywords indicative of CVE-2021-1675 exploitation.

Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)

Alerts when spoolsv.exe deletes a DLL from the Spooler driver folder path on Windows.

Antivirus detections of PrinterNightmare PoC file creation path on Windows

Alerts on antivirus events where filenames include the Windows spooler driver x64 directory path, excluding Symantec submission messages.

Windows SMB Client Security: Rejected Guest Logon with Blank UserName

Flags rejected SMB guest/anonymous-style logons on Windows when the SMB username is blank.

Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation

Looks for Print Spooler plug-in/module load errors in Windows logs that may indicate CVE-2021-1675 exploitation attempts.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption

Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.

Pulse Connect Secure web exploitation attempts for CVE-2021-22893

Detects web requests to Pulse Connect Secure with URI query patterns consistent with CVE-2021-22893 exploitation attempts.

Windows ImageLoad of DLL from spoolsv.exe spool drivers subfolders

Flags spoolsv.exe DLL loads originating from Print Spooler x64\3/x64\4 driver folders on Windows.

Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation

Flags Windows file events referencing a specific spooler driver path pattern associated with CVE-2021-1675 PoC activity.

Windows reg.exe Run Key Modification for Persistence via Process Creation

Alerts on reg.exe commands that add values to Windows Run registry keys, a common persistence technique.

AWS CloudTrail: Security Hub findings evasion via finding updates or deletions

Identifies Security Hub finding and insight modifications (update or delete) that may impair detection results.

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic

Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.