Sigma detection rules, expert-reviewed

PowerShell Script Block Collection of Browser Bookmarks via Get-ChildItem

Detects PowerShell Get-ChildItem activity used to recursively enumerate browser bookmarks from a target path.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

PowerShell Local Group Discovery via Get-LocalGroup and Get-LocalGroupMember (Windows)

Identifies PowerShell commands enumerating local groups and their members, indicating potential local permission discovery.

Windows Net.exe Network Connections Discovery via Use Sessions Query

Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

Detects PowerShell usage of Get-NetTCPConnection to enumerate TCP network connections.

Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

Windows: Network connections initiated to api.mega.co.nz or mega.nz

Identifies initiated Windows outbound connections to api.mega.co.nz/mega.nz for potential file-transfer staging.

Windows sc.exe Service Query Execution via Process Creation

Flags sc.exe executions with command lines containing " query", consistent with Windows service information discovery.

Linux auditd: getcap scanning for setuid/setgid-capable files under root

Flags getcap command-line usage scanning / for Linux capability-bearing files via auditd.

macOS: Process commands with trailing space in filename to evade matching

Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Linux dd Command Overwrite or Deletion via of= and input redirection

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.