Sigma detection rules, expert-reviewed

PowerShell Module: Obfuscated STDIN Execution via cmd /c or cmd /r

Alerts when an obfuscated cmd->PowerShell payload uses stdin-style input and noexit/no-execution patterns.

Windows Service Control Manager: Obfuscated Environment Variable PowerShell via cmd /c set -f

Alerts on Service Control Manager event 7045 where a service ImagePath uses cmd /c|/r with "set" and -f formatting.

Windows System Service Control Manager spawning cmd with PowerShell and stdin input obfuscation

Flags SCM-created services whose ImagePath runs cmd to invoke PowerShell using stdin/input and -NoExit patterns.

Windows Security 4697: cmd.exe Launching Obfuscated PowerShell via Environment Variable Expansion

Alerts on EID 4697 service installation command lines containing obfuscated cmd.exe SET patterns used to execute PowerShell via environment variables.

Windows Security Event 4697 PowerShell Launch via cmd/stdin Obfuscation

Alerts on service creation events that run PowerShell through cmd with stdin-style obfuscation markers.

macOS split Command Used to Divide Files into Parts

Flags macOS process execution of split, indicating file splitting activity that may support staging or exfiltration.

Linux split Command Used to Divide Files for Possible Exfiltration

Identifies use of the Linux split command to break files into parts, potentially for staging or exfiltration.

Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot

Identifies Linux shutdown/reboot command execution patterns using auditd execve telemetry.

Linux: Grep used to search for passwords in files (auditd EXECVE)

Flags Linux process executions running grep with “password” in the command line.

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Alerts on touch executions with timestamp options that alter file access and modification times on Linux.

Windows: Malicious Child Process Execution via vsjitdebugger.exe Just-In-Time Debugger

Flags unusual executables launched by vsjitdebugger.exe on Windows, excluding common Visual Studio helper/debugger children.

Windows Process Execution Proxy Using SyncInvoke in CL_Invocation.ps1

Alerts on Windows command lines containing "SyncInvoke" consistent with CL_Invocation.ps1 execution proxy behavior.

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

macOS Network Sniffing Tool Execution via tcpdump or tshark

Identifies macOS execution of tcpdump or tshark, indicating potential network traffic sniffing activity.

macOS Startup Item Plist Created in StartupItems Folders

Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.