Sigma detection rules, expert-reviewed

Zeek: Public RDP Connections from Non-Private IPv4/IPv6 Ranges

Alert on Zeek-observed RDP connections originating from non-excluded IP ranges, suggesting external accessibility.

Windows Process Creation: Mouse Lock Execution with “Misc314” Indicator

Alerts on Windows executions of Mouse Lock where Company includes “Misc314” and CommandLine contains “Mouse Lock_”.

Windows Defender windefend Event 1013: Malware detection history deletion

Alerts when Windows Defender deletes its malware/PUA detection history via windefend Event ID 1013.

Windows Security Event 5145: SMB Write Access to Admin Share (C$)

Flags non-machine accounts writing via SMB to the C$ administrative share using Security EventID 5145.

Webserver logs: Webshell ReGeorg indicators in POST URI query with null Referer/User-Agent

Flags HTTP POST requests with null referer/user-agent and ReGeorg-like URI query parameters in web logs.

Windows Process Creation: Winnti Pipemon setup* Command-Line Parameters

Alerts on Windows processes launching Pipemon-style setup.exe command lines with specific -p or -x:n flags.

Windows TAIDOOR RAT DLL Load via rundll32 Command Line

Detects Windows process creation command lines consistent with TAIDOOR RAT DLL loading through rundll32.exe.

Windows windefend Event ID 5012: Windows Defender virus scanning disabled

Flags when Windows Defender disables virus scanning via windefend Event ID 5012.

Windows windefend: Windows Defender threat detection and mitigation events

Alerts on windefend events indicating Windows Defender malware detection and potential remediation activity.

Windows windefend EventID 5001: Windows Defender real-time protection disabled

Flags windefend Event ID 5001 indicating Windows Defender real-time protection was disabled.

Windows windefend: Microsoft Defender malware and PUA scanning disabled (Event ID 5010)

Flags Windows Defender disabling malware and PUA scanning using Windefend Event ID 5010.

Windows Defender antimalware grace period expired (Event ID 5101)

Alerts when Windows Defender signals its antimalware grace period expired via windefend Event ID 5101.

Windows Service Control Manager: Windows Defender Threat Protection Disabled

Flags Service Control Manager events where the Windows Defender Threat Protection (Defender Antivirus) service is stopped.

Windows webserver-spawned recon commands probing scripting tool help (perl/python/wget)

Flags webserver child processes running perl/python/python3/wget help commands to probe available tooling on the host.

Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse

Alerts on MicrosoftAccountTokenProvider.dll loads on Windows, with process-based exclusions, as a signal for potential Azure Browser SSO token activity.