Sigma detection rules, expert-reviewed

Windows NTLM Logon to TERMSRV on Non-Domain Hosts

Alerts on Windows NTLM events tied to TERMSRV targets that may be non-domain hosts, suggesting potential RDP access.

Windows: Process executions matching Greenbug espionage tool indicators

Alerts on Windows process creation with command-line patterns matching PowerShell execution-policy bypass and reverse-shell related tooling.

Linux auditd: New user account creation via useradd (ADD_USER/SYSCALL)

Flags Linux auditd evidence of new local user accounts created using useradd.

Linux auditd: Alert on suspicious C2-related command executions

Alerts on auditd executions of common C2-adjacent tools when labeled with the "susp_activity" key.

Windows Network Connections Initiated by Notepad.exe

Alerts when notepad.exe initiates an outbound network connection, excluding typical printing traffic on port 9100.

Windows Registry Set: ServiceDll Path Ending with \CurrentControlSet\Services\wercplsupport\Parameters\ServiceDll

Alerts on Windows registry writes to a specific Services\wercplsupport\Parameters\ServiceDll target path.

Windows Persistence Attempt via sc config or wmic COR_PROFILER (Blue Mockingbird)

Flags sc.exe sc config and wmic.exe COR_PROFILER command lines tied to wercplsupporte.dll references.

Windows Registry Ports Key Changes with Script/Binary File Indicators

Flags registry modifications to the Ports key with path- or executable/script-like details that may indicate printer-based exploitation attempts.

Windows Process Creation: Add-PrinterPort Commands with Suspicious File Paths

Flags suspicious Add-PrinterPort usage referencing .exe/.dll/.bat or “Generic / Text Only” in Windows process command lines.

Windows: Detect rar.exe Archive Creation Using Password or Compression Options

Alerts on rar.exe command lines that include both password protection (-hp) and additional compression/archive flags.

Windows: Advanced IP Scanner (PUA) Execution via Process Creation

Identifies Windows processes running Advanced IP Scanner using filename/description and command-line arguments.

Advanced IP Scanner Execution from Temp Folder via Windows File Events

Flags file activity targeting Advanced IP Scanner 2 under a Windows user Temp directory.

Windows Office Startup Add-In Persistence via .wll/.xll/.xlam

Alerts on Office startup/add-ins DLL-based files (.wll/.xll/.xlam and related) written to Word/Excel startup paths.

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Alerts on Word-to-temp execution followed by wmic shadowcopy deletion consistent with Maze-style ransomware droppers.

Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations

Alerts when specified Azure subscription operations occur from a new, previously unseen source IP.