Sigma detection rules, expert-reviewed

Windows PowerShell Script Execution via Redirected Input Stream

Flags PowerShell/pwsh executions where the command line includes redirected input ("- <").

Windows Process Creation: Suspicious Microsoft Csi.exe or Rcsi.exe with C# Execution Capability

Alerts on Windows executions of Microsoft’s csi.exe/rcsi.exe that can be used to run C# code from command-line.

Windows WMIC loading JavaScript/VBScript engine libraries

Alerts on wmic.exe loading jscript.dll or vbscript.dll, a common sign of script execution via Windows Management Instrumentation.

macOS Process Creation: Command Line Access to Shell History Files

Flags macOS command lines referencing common shell history files, which may indicate credential access or cover-tracks behavior.

Linux: Command-Line Access to Shell History Files via execve

Alerts when executed commands reference common Linux shell history files.

Potential Windows Registry Persistence via AppCompatFlags TelemetryController Commands

Flags registry entries under TelemetryController\Command that reference executable/script payloads potentially abusing telemetry for persistence.

Windows sc.exe Security Descriptor Tampering to Deny Service Access via sdset

Alerts on sc.exe sdset commands that modify service security descriptors to deny access to critical trustees.

Windows Process: reg.exe Software Version Discovery via svcVersion Query

Alerts when reg.exe is used to query \Software\ for svcVersion, indicating Windows software version discovery.

Windows PowerShell Software Enumeration via Script Block Content

Flags PowerShell registry queries for installed software metadata combined with selection and table formatting.

PowerShell command-line obfuscation indicators from special-character patterns (Windows)

Alerts on PowerShell executions whose command lines contain repeated special-character obfuscation patterns.

Windows Process Creation: Cmd Invokes PowerShell via Obfuscated Environment Variable Expansion

Alerts on cmd.exe command lines that use obfuscated environment-variable SET to execute PowerShell.

Windows Process Execution Using Obfuscated CMD to Pipe STDIN into PowerShell

Detects obfuscated cmd executions that launch PowerShell and reference $input/noexit patterns for STDIN-based execution.

PowerShell: Obfuscated invocation via Environment Variables in Script Block

Alerts on PowerShell script blocks launching cmd /c or /r with obfuscated set-and-{n} variable expansion patterns.

PowerShell Obfuscated stdin launcher using cmd /c or cmd /r patterns

Detects PowerShell script blocks that use obfuscated STDIN-driven cmd/powershell execution patterns.

PowerShell Module: Obfuscated Environment Variable Expansion via cmd /c set -f Pattern

Alerts when PowerShell module payloads obfuscate execution via cmd /c|/r and environment-variable-based set patterns.