Sigma detection rules, expert-reviewed

WebDAV Delivery of Executable Files over HTTP (Zeek)

Flags Zeek HTTP events where WebDAV traffic serves an .exe with MIME type 'dosexec'.

Windows winget Installs Applications Using Local Manifest File

Flags winget.exe install commands that specify a local manifest file via -m/--manifest.

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Flags Windows command lines that create or copy files into C:\Windows\Fonts\ using suspicious file extensions.

Windows Netsh.exe WLAN profile key clearing used for WiFi credential harvesting

Detects netsh.exe command-line activity targeting WLAN and clearing keys, indicative of potential WiFi credential harvesting on Windows.

Windows: Process Execution of Suspicious hxtsr.exe (Outside WindowsApps)

Alerts when hxtsr.exe runs from a non-expected WindowsApps Microsoft.WindowsCommunicationsApps location.

AWS CloudTrail EC2 CreateInstanceExportTask Failure

Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.

Proxy Downloads Containing /pwndrop/ (PwnDrp Web Server)

Alerts on proxy requests to URIs containing '/pwndrop/', consistent with PwnDrp-style web delivery.

PowerShell Local User Creation via New-LocalUser

Flags PowerShell usage of New-LocalUser, indicating creation of a Windows local user.

Zeek SMB: Network Share File Transfers of Credential-Related Filenames

Flags Zeek-observed SMB share file transfers involving credential/dump-related filenames.

Zeek SMB File Access to Sensitive Email/Database/Backup Extensions

Alerts on Zeek-observed SMB file accesses to filenames ending with high-value sensitive extensions.

Windows: Alert on Suspicious HH.EXE Process Execution

Alerts on HH.exe execution where the command line references temp, downloads, Outlook, or other writable directories.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows Security Event 4662: Non-Machine Account Reads Domain User Object Properties

Alert on AD user property read attempts in Windows Event 4662 from non-machine accounts.

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)

Alerts on cmd/Pwsh/BITSAdmin and other command utilities launched by the Desktop Central Java runtime.