Sigma detection rules, expert-reviewed

SAP NetViewer Webshell Command Execution via JSP cmd Parameter

Alerts on SAP NetViewer JSP requests likely used as webshells to execute system commands via cmd-style query parameters.

Windows WER BugCheck Crash Dump Reporting via Event ID 1001

Flags Windows WER SystemErrorReporting Event ID 1001 entries indicating a crash with bugcheck and dump/report details.

Windows: Suspicious Command-Line Child Processes Spawned by SAP NetWeaver Paths

Flags SAP NetWeaver web work/root processes spawning Windows command/script tools that may indicate server-side execution.

Linux: Suspicious child processes spawned by SAP NetWeaver (web application directories)

Alerts when SAP NetWeaver work/root paths spawn common shells or utilities on Linux, indicating potential malicious command execution.

Windows File Events: SAP NetWeaver Directory Webshell File Creation (.jsp/.java/.class)

Flags Windows file creation of JSP/Java/Class under SAP NetWeaver servlet_jsp work/root paths that may indicate webshell persistence.

Linux File Events: Webshell-like JSP/Java/Class Creation in SAP NetWeaver Directories

Alerts on Linux file creation of .jsp/.java/.class under SAP NetWeaver IRJ servlet paths that may indicate webshell deployment.

Suspicious Inline JavaScript Execution by Node.js (node.exe) on Windows

Flags Windows command lines where node.exe is used with JavaScript execution indicators and module keywords consistent with malicious activity.

Windows Process Execution of JavaScript via Node.exe

Alerts when node.exe starts a process with a .js argument on Windows, which may indicate suspicious script execution.

Windows Suspicious .library-ms File Creation by 7z.exe, winrar.exe, or explorer.exe

Alerts on .library-ms file creation triggered by 7z.exe, winrar.exe, or explorer.exe, which may indicate forced-authentication style exploitation.

Suspicious cmd.exe execution from w3wp.exe tied to CentreStack portal.config (Windows process creation)

Alerts when w3wp.exe launches cmd.exe and its command line references \portal\portal.config, suggesting possible IIS app exploitation.

Windows: Suspicious child processes spawned by CrushFTP service

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

Windows Registry: MiniNt Key Added to Disable Security Event Logging on Reboot

Flags registry set activity that adds the MiniNt key, which stops Windows Event Log from writing events after a reboot.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

Windows Registry RunMRU Tampering with HTTP/HTTPS and Script Execution Indicators

Alerts on Windows RunMRU registry changes containing HTTP/HTTPS URLs plus captcha/automation or command execution indicators.