Sigma detection rules, expert-reviewed

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)

Detects dscl commands on macOS creating hidden users (UniqueID < 500 or IsHidden true).

Windows verclsid.exe executes COM object via GUID parameters

Flags verclsid.exe process launches using /S /C COM GUID-style arguments on Windows.

Windows: Identify RpcPing.exe -s RPC test that requests NTLM authentication

Detects RpcPing.exe RPC test usage with parameters indicating NTLM authentication attempts.

Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata

Flags Windows executions where PE OriginalFileName is ftp.exe but the image path is not named ftp.exe.

Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows

Flags WINWORD.exe runs that include /l and a .dll indicator, suggesting potential DLL sideloading on Windows.

Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'

Detects Runscripthelper.exe executions with "surfacecheck" in the command line on Windows.

Windows Rasautou.exe DLL loading with -d and export execution via -p

Flags Rasautou.exe running with -d and -p to load a DLL and execute a specified export.

Windows Process Creation: PowerShell Obfuscation Executed via Clip.exe and Clipboard

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.

Windows Arbitrary File Download via GfxDownloadWrapper.exe URL Argument Execution

Flags GfxDownloadWrapper.exe executions that include http/https URLs for downloading files, excluding a known Intel gameplay API URL.

Windows: Detect ftp.exe Executed With -s or /s for Script-Based Command Execution

Flags Windows executions of ftp.exe using -s or /s, indicating potential scripted command abuse.

PowerShell Script Obfuscation Triggered by Use of clip.exe and Clipboard Invocation

Flags PowerShell Script Block Logging containing clip.exe/clipboard chaining and clipboard-driven execution markers.

PowerShell module obfuscation using clip.exe with echo and clipboard invocation

Flags obfuscated PowerShell module scripts that echo “clip” and invoke clipboard-related behavior.

Windows PowerShell: Detect Suspicious Opsec Artifacts in Script Module Content

Identifies PowerShell module content containing frequent offensive payload string markers associated with poor operational security.

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.