Sigma detection rules, expert-reviewed

Windows DCOM InternetExplorer.Application iertutil.dll DLL Hijack Suspicion

Alerts when System writes iertutil.dll in the DCOM InternetExplorer.Application path, consistent with potential DLL hijacking.

Windows System: Service Control Manager runs command with obfuscated PowerShell keywords via set and stdin

Alerts on service creation where ImagePath includes obfuscation-like command chaining with environment/invoke/input strings.

Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Flags remote creation of wbemcomn.dll in System32\wbem associated with WMI DLL hijack activity.

Windows Security Event 4697: Obfuscated PowerShell Invocation Through Stdin

Alerts on Service creation events where the service command line includes stdin-style PowerShell obfuscation indicators.

Windows Security: Remote DCOM IE DLL Hijack via iertutil.dll in Internet Explorer path

Flags network file writes of iertutil.dll under IE’s Program Files path associated with potential DCOM DLL hijacking.

Windows Registry Screensaver Path Value Modified (SCRNSAVE.EXE)

Alerts on registry changes to the SCRNSAVE.EXE screensaver binary path under HKCU.

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

Windows Process Creation: Detect Reversed PowerShell Command Tokens in CommandLine

Alerts on suspicious reversed token usage in PowerShell command lines on Windows, excluding -EncodedCommand / -enc.

PowerShell ConvertTo-SecureString Cmdlet Execution from Command Line (Windows)

Alerts when PowerShell is launched with a command line containing ConvertTo-SecureString, a credential-related cmdlet uncommon in normal execution.

Windows msbuild.exe Network Connections to Ports 80/443

Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.

macOS Local Group Enumeration via dscacheutil, cat /etc/group, or dscl

Flags macOS process executions that enumerate local system groups using dscacheutil, cat, or dscl commands.

macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths

Flags macOS rm/unlink/shred commands targeting /var/log or ~/Library/Logs to remove local log evidence.

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

PowerShell Root Certificate Added via LocalMachine\Root Path

Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).