Sigma detection rules, expert-reviewed

Windows Service Creation Indicators for Moriya Rootkit (ZzNetSvc via Service Control Manager)

Alerts on creation of the "ZzNetSvc" service by Service Control Manager (Event ID 7045) on Windows.

Windows Driver File MoriyaStreamWatchmen.sys Created in System32\drivers

Alerts when the Windows system32 drivers directory receives the MoriyaStreamWatchmen.sys file.

Windows whoami.exe Privilege Enumeration Using /priv Flag

Alerts on whoami.exe runs with /priv or -priv to enumerate current user privileges.

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

Windows Pingback backdoor via ICMP C2 using updata.exe command-line parameters

Flags Windows process creation where updata.exe spawns msdtc config start auto commands consistent with Pingback backdoor.

Windows DLL Loading of C:\Windows\oci.dll by msdtc.exe

Flags msdtc.exe loading C:\Windows\oci.dll, consistent with Pingback backdoor DLL loading behavior.

Windows File Indicator for Pingback Backdoor updata.exe Writing oci.dll

Alerts on updata.exe creating or modifying C:\Windows\oci.dll as a Pingback backdoor file indicator.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows Security: Hidden Local User Account Creation (Event ID 4720)

Alerts on Windows 4720 local user creation for hidden accounts (username ending with '$'), excluding 'HomeGroupUser$'.

Windows Process Access to svchost.exe with Credential Dumping Access Rights

Alerts on attempts to read svchost.exe memory consistent with credential dumping, excluding known benign callers.

PowerShell Defender Exclusion via Set/Add-MpPreference Command-Line Flags (Windows)

Detects PowerShell commands that add or set Microsoft Defender exclusions using Add/Set-MpPreference parameters.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate

Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.