Sigma detection rules, expert-reviewed

Linux setcap sets cap_setuid on a binary via setcap utility

Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Flags Linux setcap commands that set cap_setgid on binaries via process creation logs.

Windows Registry Query for System Language Using reg.exe

Flags reg.exe registry queries to Control\Nls\Language, indicating system language discovery on Windows.

Microsoft 365 Audit Logs: Inbox Rule Creation or Update with Email Hiding Actions

Flags M365 audit events where inbox rules are created/updated with parameters that can delete, mark, move, or keyword-match messages.

OpenCanary RDP New Connection Attempt on Application Logtype 14001

Alerts on OpenCanary logging a new RDP connection attempt (logtype 14001), indicating remote access probing.

OpenCanary Application Logs: Detect SYN Port Scan Targets on a Hosted Node

Flags OpenCanary events indicating the host was probed with a TCP SYN port scan.

OpenCanary application logs: detect NMAP XMAS scans targeting an OpenCanary node

Detects OpenCanary log events showing an Nmap Xmas scan targeting the monitored node.

OpenCanary: Detect NMAP OS Scan Targets via Application Logtype 5002

Alerts when OpenCanary records an NMAP OS scan event (logtype 5002), indicating host fingerprinting activity.

OpenCanary - Nmap NULL Scan Targeting Detected

Detects OpenCanary logtype 5003 events consistent with NMAP NULL scan targeting.

OpenCanary Application Logs: Nmap FIN Scan Targeting (Logtype 5005)

Detects Nmap FIN scan targeting against an OpenCanary node using application logs with logtype 5005.

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

Windows: Kernel Driver Utility (KDU) and hamakaze.exe Execution

Alerts on KDU/hamakaze.exe launches with command-line parameters associated with kernel driver loading.

Windows devcon.exe Command Line Disabling VMware VMCI Device

Flags devcon.exe command lines that disable VMware VMCI using VMCI PCI ID or VMWVMCIHOSTDEV driver markers.

Windows Registry Set: Disable Windows Credential Guard by Zeroing EnableVirtualizationBasedSecurity

Alerts on registry value changes that zero Credential Guard/LSA configuration flags to disable virtualization-based secret protection.

Windows Registry Delete of Credential Guard EnableVirtualizationBasedSecurity or LsaCfgFlags

Flags deletion of Credential Guard/LSA-related registry values that may weaken virtualization-based secret protection.