Sigma detection rules, expert-reviewed

Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation

Flags Windows file events referencing a specific spooler driver path pattern associated with CVE-2021-1675 PoC activity.

Windows reg.exe Run Key Modification for Persistence via Process Creation

Alerts on reg.exe commands that add values to Windows Run registry keys, a common persistence technique.

AWS CloudTrail: Security Hub findings evasion via finding updates or deletions

Identifies Security Hub finding and insight modifications (update or delete) that may impair detection results.

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic

Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.

Windows PortProxy Registry Key Modified for Port Forwarding

Alerts when PortProxy port-forwarding registry entries under the Windows TCP v4tov4 path are added or modified.

Windows: Detect execution of renamed megasync.exe (original MegaSync) via process creation

Flags process launches where megasync.exe appears under a renamed or nonstandard execution context based on process creation fields.

Windows LDAP Client Event ID 30 Active Directory enumeration via LDAP search filters

Flags LDAP search queries indicative of Active Directory reconnaissance/enumeration using Event ID 30 filter patterns.

Windows: Suspicious Child Process Spawned by scrcons.exe (Script Event Consumer)

Alerts on rare child processes spawned by scrcons.exe, which may indicate abuse of Script Event Consumer for execution.

Windows Registry: New TaskCache entry created by unusual process image

Alerts when TaskCache registry entries are created by processes other than a defined set of expected Windows binaries.

Windows Execution of PurpleSharp HackTool by Image Name or Executable Metadata

Alerts on process creation events consistent with running PurpleSharp.exe on Windows.

Windows process and registry activity matching SOURGUM persistence/privilege escalation behavior

Alerts on Windows process activity referencing specific system/IME WimBoot files and registry 'reg add' changes targeting HKLM CLSID inprocserver32.

Windows: Process writes registry to disable storage write-protection

Alerts on Windows process command lines that appear to disable storage write-protection via registry modification.

Windows Registry Set—Custom Outlook Today Page for Persistence

Flags registry writes that configure a custom Outlook Today URL using Outlook Today registry values.

Windows Persistence Attempt Using Outlook.exe to Create Outlook Forms Cache

Flags Outlook (outlook.exe) form file activity targeting local FORMS directories often used for persistence.