Sigma detection rules, expert-reviewed

PowerShell share removal via Remove-SmbShare or Remove-FileShare on Windows

Flags PowerShell commands that remove SMB or file shares through Remove-SmbShare/Remove-FileShare.

PowerShell ScriptBlock Obfuscation via MSHTA VBScript CreateObject Execution

Alerts on PowerShell script blocks containing mshta and VBScript createobject/.run/window.close patterns consistent with obfuscated execution.

PowerShell Module: Obfuscated MSHTA Invocation via VBS CreateObject

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.

macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands

Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.

Linux System Information Discovery via Common Command-Line Utilities

Flags Linux executions of uname, hostname, uptime, lspci, dmidecode, lscpu, and lsmod for system discovery behavior.

Linux Local Account Enumeration via lastlog, /etc/* file reads, id, and lsof -u

Flags Linux process activity consistent with enumerating local system accounts using /etc account data and related tools.

Linux System & Hardware Information Discovery via File and Version Reads

Detects Linux file access to BIOS/DMI, hardware model, kernel, and OS release/issue identifiers used for system profiling.

Linux Password Policy Discovery via chage and passwd Commands

Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.

UAC Bypass Using wsreset.exe Registry Command Path (Windows)

Identifies registry TargetObject values associated with a wsreset-style UAC bypass execution command path on Windows.

Xwizard.EXE COM Execution with RunWizard and GUID Argument (Windows)

Alerts when Xwizard.EXE runs with RunWizard plus a GUID-like argument on Windows, consistent with COM execution usage.

Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create

Alerts on cscript.exe executions referencing winrm and wmicimv2/Win32_ Create with -r:http, consistent with remote code execution via winrm.vbs.

Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.

Windows DLL execution via register-cimprovider.exe with -path dll

Alerts on register-cimprovider.exe launching with -path pointing to a DLL.

Windows regedit.exe Imports Registry Keys From .reg File

Detects regedit.exe command lines importing registry keys from .reg files on Windows.

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.