Sigma detection rules, expert-reviewed

Windows Process Creation: rundll32.exe Command Line Invoking .sys Files

Flags Windows rundll32.exe executions whose command line references .sys file patterns.

Windows rundll32 Executing Inline VBScript via RegRead

Detects rundll32.exe command lines containing inline VBScript execution with RegRead and window.close.

Windows Process Command Line: Suspicious Inline VBScript with UN2452-Like Keywords

Alerts on Windows command lines containing inline VBScript keywords and registry access indicators matching the UNC2452 UN2452 pattern.

Windows Process Creation: Exchange PowerShell Snap-in Loading via Add-PSSnapin

Flags PowerShell executions that Add-PSSnapin Exchange snap-ins, consistent with Exchange mailbox/config data collection.

Windows PowerShell TcpClient reverse-shell connection attempt via Net.Sockets

Alerts on PowerShell processes launching with .NET TcpClient stream/write patterns consistent with reverse TCP connectivity.

Microsoft Exchange exploitation attempt via suspicious POST requests in web server logs

Flags POST traffic to Exchange OWA/ECP-related URLs with specific client and user-agent indicators consistent with exploitation attempts.

Windows Exchange UMWorkerProcess File Drops Indicating CVE-2021-26858 Exploitation

Alerts on Exchange Unified Messaging (UMWorkerProcess.exe) creating unusual files, excluding common benign names consistent with CVE-2021-26858 activity.

Windows Process Creation: Suspected CVE-2021-26857 Exploitation via UMWorkerProcess.exe

Detects suspicious child process spawning by Exchange Unified Messaging (UMWorkerProcess.exe) associated with CVE-2021-26857 attempts.

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.

Windows Process Creation: finger.exe Execution

Alerts on Windows executions of finger.exe, a legacy utility that may indicate suspicious reconnaissance or network activity.

Webserver POST to vROps uploadova endpoint indicative of CVE-2021-21972 exploitation

Alerts on POST requests to the uploadova endpoint tied to CVE-2021-21972 vSphere exploitation.

Webserver URI Detects DEWMODE Webshell Access Attempts

Identifies webserver requests with DEWMODE webshell-specific URI query parameter patterns.

Windows ScreenConnect Installation Execution via Remote Access Parameters

Flags Windows executions of ScreenConnect with remote access command-line parameters indicating remote session setup.

Windows Process Creation: logman.exe Used to Stop or Delete ETW Trace Sessions

Alerts when logman.exe is used to stop or delete Windows ETW trace sessions.

Windows Process Creation: AdFind Executed with Suspicious Recon Flags

Detects AdFind executions on Windows that include common AD reconnaissance parameters.