Sigma detection rules, expert-reviewed

Windows Process Creation: Command-Line Indicators of Crypto Mining

Alerts on Windows processes with command-line arguments matching common crypto miner pool and configuration indicators.

Windows Network Connections to Known Crypto Mining Pools

Flags Windows hosts making outbound connections to known cryptocurrency mining pool domains.

Linux Process Creation Crypto Miner Command-Line Indicators

Alerts on Linux process executions with command-line strings typical of crypto mining pools, stratum endpoints, and miner options.

Linux Process Network Connections to Crypto Mining Pool Hosts

Flags Linux outbound connections to known Monero mining pool domains.

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

DNS Queries for Monero Mining Pool Domains

Alerts on DNS queries to known Monero mining pool domains that may indicate cryptomining activity.

Windows Process Execution via WorkFolders.exe Launching control.exe

Alerts when WorkFolders.exe spawns a non-standard control.exe instance on Windows.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.

Windows Registry: Clearing RDP Client Connection History via MRU and Server Keys Deletion

Flags registry deletions that remove Windows RDP client connection history from Terminal Server Client MRU and Servers keys.

Linux Process Creation Webshell Tooling: Web Server Child Processes Running System Commands

Detects web server processes spawning Linux command-line tools commonly used for host discovery or persistence.

Linux Syslog Clearing or Removal Using System Utilities

Alert on Linux commands that clear, delete, truncate, or redirect /var/log/syslog or rotate/vacuum journald logs.

Windows vmtoolsd.exe Child Process Spawn via Scripting/Utility Binaries

Alert on vmtoolsd.exe spawning cmd/powershell/mshta/regsvr32/rundll32/wscript child processes with VM Tools batch-script command lines.

Windows Registry Writes for NetWire-Related Keys

Flags newly added Windows registry keys with paths containing \\software\\NetWire, consistent with potential NetWire-related persistence.

Apache HTTP Server Web Path Traversal Attempt via Encoded Traversal Sequences (CVE-2021-41773)

Alerts on Apache requests with encoded traversal strings that return 200/301, consistent with CVE-2021-41773 probing.

Windows Prefetch File Deletion via .pf File Removal

Flags deletion of .pf files in \\Windows\\Prefetch, a possible attempt to remove execution artifacts.