Sigma detection rules, expert-reviewed

Windows Diskshadow Script Mode Execution via /s Flag

Alerts when Diskshadow is executed in script mode using the /s flag.

PowerShell Service Persistence via Registry ImagePath on Windows

Flags Windows registry service ImagePath entries that reference PowerShell (powershell/pwsh).

Windows: Winrm.vbs AWL bypass using attacker WsmPty.xsl/WsmTxt.xsl

Detects WinRM vbs execution with suspicious XSL formatting arguments, especially when the binary is outside System32/SysWOW64.

Windows: VBoxDrvInst.exe Invoked with driver/executeinf Parameters

Flags VBoxDrvInst.exe launched with parameters indicative of INF processing (driver/executeinf).

Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Alerts when tttracer.exe is the parent process of a spawned process on Windows.

PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.

Windows UAC Bypass via dism.exe Loading Fake dismcore.dll

Alerts when dism.exe loads a dismcore.dll that is not the expected System32 Dism DLL.

Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)

Flags Windows image loads of Time Travel Debugging Utility DLLs (tdrecord/tdwriter/tdloader), often abused for stealthy credential dumping.

Windows file events: Winrm.vbs payload XSL execution artifacts WsmPty.xsl/WsmTxt.xsl outside system folders

Alert on WsmPty.xsl/WsmTxt.xsl files written outside System32 and SysWOW64, consistent with WinRM VBScript misuse.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Script Execution via Windows Service Creation (Service Control Manager)

Flags service creation/start events where the service ImagePath references PowerShell (powershell/pwsh).

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.

macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults

Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.

macOS Cron Task Abuse via crontab Executed from /tmp

Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.

macOS Local User Account Creation via dscl or sysadminctl

Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.