Sigma detection rules, expert-reviewed

Windows: Command-line contains long ab-prefixed string seen in TropicTrooper activity (Nov 2018)

Detects Windows processes whose command line contains a known TropicTrooper campaign indicator string.

Windows Process Creation: Detect Obfuscated PowerShell IEX Invocation from Invoke-Obfuscation

Detects PowerShell commands showing obfuscation markers consistent with Invoke-Obfuscation-powered IEX invocation.

PowerShell: Obfuscated IEX Invocation via Invoke-Obfuscation String/Variable Patterns

Alerts on obfuscated PowerShell IEX invocation strings built from Invoke-Obfuscation style concatenation patterns in ScriptBlockText.

PowerShell Module Obfuscated IEX Invocation via Invoke-Obfuscation Payload Patterns

Alerts when PowerShell module payloads contain patterns consistent with obfuscated IEX generation via Invoke-Obfuscation.

Windows System Service Creation of Obfuscated PowerShell IEX (Invoke-Obfuscation)

Flags Windows service creations whose ImagePath contains obfuscated PowerShell IEX invocation strings.

Windows Security: Detect Obfuscated PowerShell IEX Invocation via ServiceFileName Patterns (Event ID 4697)

Alerts on EventID 4697 instances where ServiceFileName matches obfuscated IEX-style PowerShell invocation patterns consistent with Invoke-Obfuscation.

Windows: Detect netsh.exe Commands Disabling Firewall

Flags netsh.exe executions that include command-line patterns used to disable Windows firewall.

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Flags PowerShell ScriptBlockText that combines Empire process-control indicators with dnscat DNS tunneling commands.

Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names

Alerts on Windows named pipe creations matching credential dumping tool pipe names.

Windows Credential Dump Tool Artifacts Written to Disk via File Events

Detects Windows file creation where the target filename contains or ends with known credential-dump tool or output names.

Windows Security: Suspicious AccessMask on LSASS Handle Requests (4656/4663)

Flags processes requesting potentially credential-dumping-related access to LSASS based on Security Event 4656/4663.

Windows Security: Suspicious Local Account Created with ANONYMOUS LOGON SamAccountName

Alerts on Windows local account creation where the new SamAccountName contains “ANONYMOUS” and “LOGON”.

Windows PowerShell Script Execution from Alternate Data Stream (ADS)

Flags PowerShell processes using Get-Content -Stream to execute or retrieve script content from an ADS.

Windows Process Creation Matching Mustang Panda Dropper Command-Line and winwsh.exe

Alerts on Windows process creation with temp-based wtaks/winwsh execution and script-launch command-line parameters.

Windows process creation: Suspicious Dtrack RAT ping and network recon commands

Alerts on Windows command-line reconnaissance patterns resembling Dtrack RAT activity.