Sigma detection rules, expert-reviewed

Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket

Alerts on Windows Event ID 4697 service installs matching SYSTEMROOT\8char.exe and on-demand start, consistent with PsExec-style SMB execution.

Windows Plink Remote Port Forwarding via -R Command Line

Alerts on Windows process command lines using Plink " -R " remote port forwarding to a local port.

Windows System Log: NTFS File System Driver Event 55 Indicates Possible NTFS Exploitation

Alerts on Windows NTFS Event ID 55 indicating a corrupted file record with a matching filename string in the event description.

Cisco ASA FTD web exploitation attempt matching CVE-2020-3452 with HTTP 200

Detects HTTP 200 requests targeting Cisco ASA/FTD web parameters associated with CVE-2020-3452 exploit behavior.

Windows: Suspicious Child Processes Spawned by sqlservr.exe

Alerts when SQL Server (sqlservr.exe) spawns suspicious command/system tools on Windows.

Windows Process Tree: rundll32.exe launching wermgr.exe via DllRegisterServer

Flags rundll32.exe spawning wermgr.exe where rundll32 command line includes DllRegisterServer.

Web server request pattern consistent with Oracle WebLogic CVE-2020-14882 exploitation

Detects WebLogic console exploitation attempts by matching encoded traversal patterns in HTTP URI query strings.

Windows Registry Run Key Modification via winekey or team9 backdoor

Detects registry Run key changes to "Backup Mgr" that may indicate persistence via winekey/team9.

Windows Image Load of PCRE.NET Package Temp Module Path

Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.

Windows Processes Creating PCRE.NET Temp Package Files

Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.

Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents

Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.

Windows Process Creation: Default-Argument Invocation of Rundll32/WerFault/Regsvcs/Regasm/Regsvr32

Alerts on suspicious Windows process launches of key binaries with missing/empty arguments, excluding common Edge/Chromium installer use.

Windows Registry: Detect esentutl.exe activity under VSS service keys

Flags registry changes under VSS service keys when initiated by esentutl.exe, consistent with VSS-related abuse.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

macOS Process Creation: grep 'password' or laZagne Credential Extraction

Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.