Sigma detection rules, expert-reviewed

Linux System Network Discovery via Firewall/Network Tools

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

Linux Cron Abuse via crontab Executed with /tmp/ File Paths

Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.

Linux at/atd Process Execution via /at or /atd

Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.

Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

PowerShell Remote Thread Creation (Windows CreateRemoteThread)

Alerts when PowerShell creates a remote thread in another process, excluding CompatTelRunner.exe activity.

Linux process discovery via common process listing and monitoring tools

Flags Linux execution of common tools used to enumerate running processes.

Non-privileged reg.exe or PowerShell registry service configuration changes on Windows

Flags non-admin reg.exe or PowerShell activity targeting service registry configuration paths on Windows.

Windows Print Executable Misuse via print.exe Command-Line

Flags suspicious print.exe invocations using /D and .exe, excluding command lines that explicitly contain print.exe.

Windows: Rundll32 LaunchApplication via pcwutl.dll

Flags rundll32.exe using pcwutl.dll to invoke LaunchApplication.

Windows Process Creation: Hydra Password Bruteforce Command-Line Parameters

Alerts when Windows process command lines include Hydra -u/-p parameters with USER/PASS placeholders.

Windows findstr.exe Subfolder and Case-Insensitive Search Flags

Alerts on findstr.exe executions that include both -s (subfolders) and -i (case-insensitive) flags.

Windows: SyncAppvPublishingServer.exe execution via PowerShell script block content

Flags PowerShell script blocks that reference SyncAppvPublishingServer.exe, indicating possible execution via a PowerShell-restricted workflow.

Windows SyncAppvPublishingServer Execution Triggering PowerShell Module Context

Alerts when SyncAppvPublishingServer.exe appears in PowerShell module ContextInfo on Windows.

Windows Security: Suspicious Remote Logon Using Explicit Credentials via Command-Line Tools

Flags EventID 4648 remote logons initiated by cmd/PowerShell/winrs/wmic/net/reg-style processes using explicit credentials.