Sigma detection rules, expert-reviewed

Windows WSASS Process Execution via WerFaultSecure.EXE

Alerts on Windows process creation showing wsass.exe running with WerFaultSecure.exe and a PID-like argument.

Windows Process: GPME Used to Modify Default Domain and Default Domain Controllers GPOs

Flags MMC launching GPME to target Default Domain/Default Domain Controllers GPO objects by GUID via gpobject.

Windows ImageLoad of Unsigned .node Native Add-on Files

Alerts on Windows loading of unsigned or unverifiable .node files, indicating potential native code execution in Electron-based apps.

Windows Security Event 5136 for Changes to Default Domain and Default Domain Controllers GPOs

Flags EventID 5136 modifications to Default Domain or Default Domain Controllers GPO containers in Windows AD.

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Alerts on Linux file events for filenames that appear to embed Base64-decoding bash command patterns.

Linux File Creation with Unusually Long Filenames (100+ Characters)

Flags Linux file creations with filenames 100+ characters long, excluding specific known benign system paths, to support threat hunting.

macOS Atomic Stealer FileGrabber and curl POST to exfiltrate /tmp/out.zip

Alert on macOS command lines showing FileGrabber from /tmp or curl POST exfiltration with /tmp/out.zip.

macOS File Persistence from Atomic MacOS Stealer (helper file and LaunchDaemon plist)

Flags macOS file creations used as persistence artifacts: per-user .helper files and a specific LaunchDaemon plist.

Cisco ASA WebVPN Proxy GET Requests to MacTunnel and csvrloader Paths

Alerts on proxy-observed HTTP GET requests to specific Cisco ASA WebVPN exploit-related URI stems.

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Alerts on explorer.exe child process launches with clipboard markers and anti-bot/CAPTCHA-related wording indicating ClickFix/FileFix execution.

Windows Network Connection Initiated by finger.exe

Alerts on Windows network connections started by finger.exe, an unusual utility that can support remote command retrieval.

Windows DNS Queries Triggered by finger.exe

Alerts on Windows DNS queries made by finger.exe, a rarely used utility that can be abused to fetch remote commands.

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Flags PowerShell command lines that reference KerberosRequestorSecurityToken and .GetRequest() for suspicious Kerberos ticket requests.

Windows RDP Enable/Disable via Win32_TerminalServiceSetting WMI Tool Commands

Flags WMIC/PowerShell command lines that reference Win32_TerminalServiceSetting SetAllowTSConnections to change RDP.

Windows svchost.exe Uncommon Command-Line Parameter Process Creation

Alerts on Windows process starts of svchost.exe that include an uncommon -k parameter format, after excluding common and benign patterns.