Sigma detection rules, expert-reviewed

PowerShell Script Execution via Windows Service Creation (Service Control Manager)

Flags service creation/start events where the service ImagePath references PowerShell (powershell/pwsh).

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.

macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults

Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.

macOS Cron Task Abuse via crontab Executed from /tmp

Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.

macOS Local User Account Creation via dscl or sysadminctl

Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.

Linux System Network Discovery via Firewall/Network Tools

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

Linux Cron Abuse via crontab Executed with /tmp/ File Paths

Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.

Linux at/atd Process Execution via /at or /atd

Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.

Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

PowerShell Remote Thread Creation (Windows CreateRemoteThread)

Alerts when PowerShell creates a remote thread in another process, excluding CompatTelRunner.exe activity.

Linux process discovery via common process listing and monitoring tools

Flags Linux execution of common tools used to enumerate running processes.

Non-privileged reg.exe or PowerShell registry service configuration changes on Windows

Flags non-admin reg.exe or PowerShell activity targeting service registry configuration paths on Windows.

Windows Print Executable Misuse via print.exe Command-Line

Flags suspicious print.exe invocations using /D and .exe, excluding command lines that explicitly contain print.exe.

Windows: Rundll32 LaunchApplication via pcwutl.dll

Flags rundll32.exe using pcwutl.dll to invoke LaunchApplication.