Sigma detection rules, expert-reviewed

macOS Local Group Enumeration via dscacheutil, cat /etc/group, or dscl

Flags macOS process executions that enumerate local system groups using dscacheutil, cat, or dscl commands.

macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths

Flags macOS rm/unlink/shred commands targeting /var/log or ~/Library/Logs to remove local log evidence.

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

PowerShell Root Certificate Added via LocalMachine\Root Path

Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)

Detects dscl commands on macOS creating hidden users (UniqueID < 500 or IsHidden true).

Windows verclsid.exe executes COM object via GUID parameters

Flags verclsid.exe process launches using /S /C COM GUID-style arguments on Windows.

Windows: Identify RpcPing.exe -s RPC test that requests NTLM authentication

Detects RpcPing.exe RPC test usage with parameters indicating NTLM authentication attempts.

Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata

Flags Windows executions where PE OriginalFileName is ftp.exe but the image path is not named ftp.exe.

Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows

Flags WINWORD.exe runs that include /l and a .dll indicator, suggesting potential DLL sideloading on Windows.

Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'

Detects Runscripthelper.exe executions with "surfacecheck" in the command line on Windows.

Windows Rasautou.exe DLL loading with -d and export execution via -p

Flags Rasautou.exe running with -d and -p to load a DLL and execute a specified export.

Windows Process Creation: PowerShell Obfuscation Executed via Clip.exe and Clipboard

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.

Windows Arbitrary File Download via GfxDownloadWrapper.exe URL Argument Execution

Flags GfxDownloadWrapper.exe executions that include http/https URLs for downloading files, excluding a known Intel gameplay API URL.