Sigma detection rules, expert-reviewed

Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin

Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.

Windows reg.exe Registry Hive Dumping for SAM, SYSTEM, and SECURITY

Flags reg.exe command lines exporting or saving HKLM registry hives tied to SAM, SYSTEM, and SECURITY.

Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Flags Windows process creation events containing "st2stager" in PE metadata, indicating SILENTTRINITY stager activity.

Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage

Flags Windows processes whose command lines contain Mimikatz names and credential-dumping module/function arguments.

Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS

Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.

Windows Volume Shadow Copy Symlink Creation Using mklink

Flags Windows mklink commands that reference HarddiskVolumeShadowCopy to create symlinks.

Windows: Detect sc.exe Service Config binPath Changes to Suspicious Commands/Paths

Alerts when sc.exe updates a service binPath to point at suspicious commands or commonly abused directories.

Suspicious Crypto Miner User Agents in Proxy Logs

Flags proxy requests with User-Agent prefixes tied to XMRig or CCMiner crypto miners.

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Alerts on Linux process command lines containing ' -u#' indicative of sudo CVE-2019-14287 exploitation attempts.

Windows OpenWith.exe Launches Another Binary via /c

Flags Windows OpenWith.exe executions that include '/c', indicating it launched another binary.

Windows Devtoolslauncher.exe LaunchForDeploy Executes a Specified Binary

Alerts when devtoolslauncher.exe runs with LaunchForDeploy, indicating it may launch another binary on Windows.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.

PowerShell module: Obfuscated Invoke via rundll32/shell32.dll comspec iex patterns

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

Windows Suspicious Run Key Created from Downloads or Outlook/IE Temporary Folders

Alerts on registry Run key writes originating from Downloads or temporary Outlook/IE directories on Windows.

Suspicious Windows Program Execution from Outlook Temporary Internet Files Folder

Alerts on process executions whose image path points to Outlook temporary files (Content.Outlook).