Sigma detection rules, expert-reviewed

Windows GPO Scheduled Task Persistence via SYSVOL ScheduledTasks.xml Writes (Security 5136/5145)

Alerts on GPO changes writing ScheduledTasks.xml to SYSVOL, indicating scheduled-task persistence at scale.

Windows Security 4661 Detects Privileged AD User/Group SID Enumeration via SAM

Identifies SAM_USER/SAM_GROUP access events (4661) aimed at privileged SIDs or names containing 'admin' while ignoring computer accounts.

Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor

Flags directory ACL changes (EventID 5136) that include DCSync extended right GUIDs in ntSecurityDescriptor for DNS objects.

Windows Suspicious EXE in User Directory Launched by Microsoft Office Applications

Alert on Office spawning a .exe from C:\users\ (except when the child is Teams.exe).

Linux Suspicious Reverse Shell Command-Line Execution Patterns

Alerts on Linux command lines containing reverse-shell-style strings such as /dev/tcp redirections, netcat pipes, and socket connect patterns.

Windows process creation matching EmpireMonkey-style jscript execution from Temp Errors.bat

Alerts on Windows executions that combine /e:jscript with a \Local\Temp\Errors.bat batch path.

Windows Security Event 5136: Suspicious LDAP attribute display names used

Alerts on Event 5136 containing specific LDAP display names indicative of LDAP-based data exchange.

Windows ETW Trace Evasion via Clearing/Disabling Logs or Providers

Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.

Microsoft BITS Proxy Activity to Uncommon Top-Level Domains

Flags Microsoft BITS-initiated proxy requests to domains using uncommon TLDs.

Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Alerts on Windows process creation where PowerShell uses mshta over HTTP and includes .hta, registry query, and cmd.exe termination.

Windows mshta.exe Execution Using Non-HTA File Extensions

Alerts on mshta.exe launched with command-line indicators for suspicious non-HTA file types and VBScript.

Windows: RDP Session Startup Folder Backdoor via tsclient Share Targeting Startup Path

Flags mstsc.exe activity writing to the Windows Startup folder, indicating potential RDP session backdoor placement.

Windows svchost RDP via Reverse SSH Loopback Tunnel to 127.0.0.0/8:3389

Flags svchost.exe opening RDP (TCP 3389) connections to loopback, consistent with tunneled reverse access behavior.

Windows WFP Event 5156: RDP traffic via loopback when hosted by svchost termsvcs

Flags Windows EventID 5156 where svchost RDP (3389) traffic targets loopback addresses, suggesting tunneled local RDP usage.

Windows Registry Persistence Attempt Using AppDataLow Ursnif-Related Path

Alerts on Windows registry key additions matching a Ursnif-associated TargetObject path.