Sigma detection rules, expert-reviewed

Linux Local Account Enumeration via lastlog, /etc/* file reads, id, and lsof -u

Flags Linux process activity consistent with enumerating local system accounts using /etc account data and related tools.

Linux System & Hardware Information Discovery via File and Version Reads

Detects Linux file access to BIOS/DMI, hardware model, kernel, and OS release/issue identifiers used for system profiling.

Linux Password Policy Discovery via chage and passwd Commands

Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.

UAC Bypass Using wsreset.exe Registry Command Path (Windows)

Identifies registry TargetObject values associated with a wsreset-style UAC bypass execution command path on Windows.

Xwizard.EXE COM Execution with RunWizard and GUID Argument (Windows)

Alerts when Xwizard.EXE runs with RunWizard plus a GUID-like argument on Windows, consistent with COM execution usage.

Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create

Alerts on cscript.exe executions referencing winrm and wmicimv2/Win32_ Create with -r:http, consistent with remote code execution via winrm.vbs.

Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.

Windows DLL execution via register-cimprovider.exe with -path dll

Alerts on register-cimprovider.exe launching with -path pointing to a DLL.

Windows regedit.exe Imports Registry Keys From .reg File

Detects regedit.exe command lines importing registry keys from .reg files on Windows.

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.

Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter

Alerts when vbc.exe spawns cvtres.exe during Windows VB command-line compilation activity.

Windows: Process CallTrace using EditionUpgradeManager COM interface DLL

Alerts on process access events with call traces referencing editionupgrademanagerobj.dll via the EditionUpgradeManager COM interface.

Windows regedit.exe exports a registry key into an alternate data stream

Flags regedit.exe executions where the process image ends with '\regedit.exe', consistent with exporting Registry data to an alternate data stream.

Linux Process Creation: File Deletion via rm, shred, or unlink

Alerts on Linux process executions of rm, shred, or unlink used to delete files.

Linux process attempts to delete log files using rm, rmdir, shred, or unlink

Flags Linux attempts to remove or destroy log files via rm/rmdir/shred/unlink when /var/log or mail spool paths are referenced.