Sigma detection rules, expert-reviewed

Windows: WinRM Service Process Spawning Command-Line and Scripting Utilities

Flags suspicious child shells and admin utilities spawned by the WinRM host process (wsmprovhost.exe) on Windows.

PowerShell Script Block Logging: PowerView cmdlet names match

Alerts when PowerShell ScriptBlockText includes PowerView/PowerSploit reconnaissance cmdlet names tied to domain and access discovery.

Windows Process Command Lines Indicating ngrok.exe Tunnel Setup

Detects Windows executions of ngrok.exe with TCP/HTTP tunneling and authtoken/start-all YAML configuration patterns.

Windows: Detect Rclone command execution with exfiltration-oriented flags

Identifies likely rclone.exe exfiltration activity on Windows by matching command-line flags and rclone executable characteristics.

Windows whoami.exe Privilege Enumeration Using /priv Flag

Alerts on whoami.exe runs with /priv or -priv to enumerate current user privileges.

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

Windows Pingback backdoor via ICMP C2 using updata.exe command-line parameters

Flags Windows process creation where updata.exe spawns msdtc config start auto commands consistent with Pingback backdoor.

Windows DLL Loading of C:\Windows\oci.dll by msdtc.exe

Flags msdtc.exe loading C:\Windows\oci.dll, consistent with Pingback backdoor DLL loading behavior.

Windows File Indicator for Pingback Backdoor updata.exe Writing oci.dll

Alerts on updata.exe creating or modifying C:\Windows\oci.dll as a Pingback backdoor file indicator.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows Security: Hidden Local User Account Creation (Event ID 4720)

Alerts on Windows 4720 local user creation for hidden accounts (username ending with '$'), excluding 'HomeGroupUser$'.

Windows Process Access to svchost.exe with Credential Dumping Access Rights

Alerts on attempts to read svchost.exe memory consistent with credential dumping, excluding known benign callers.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.