Sigma detection rules, expert-reviewed

Windows Cmd.exe: SET /p file append/override pattern via set /p=

Alerts on Cmd.exe command lines containing SET /p= syntax that may be used with redirection to modify file contents.

macOS chflags Hidden Flag Set via chflags hidden parameter

Alerts when chflags is run with the hidden flag on macOS to make files or directories less visible.

Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0

Alerts on Azure Entra user updates that change StrongAuthenticationRequirement to a disabled State ("State":0).

Windows Process Creation: BCP.EXE Used to Export SQL Data

Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.

Azure AD Audit: Update User Risk and MFA Registration Policy

Flags Azure AD audit events showing updates to user risk and MFA registration policy.

macOS Process Creation: hdiutil Used to Attach or Mount Disk Images

Flags hdiutil usage on macOS when command lines indicate disk image attachment or mounting.

macOS hdiutil Disk Image Creation via Process Execution

Flags macOS executions of hdiutil with the 'create' option, consistent with disk image creation.

Windows Process Masquerading as svchost.exe via Binary Name and Location

Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.

Windows Rundll32 Execution of Ammy Admin Agent DLL

Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.

Windows: cmd.exe Launched by AnyViewer Agent (AVCore.exe)

Alerts when AnyViewer’s AVCore.exe launches cmd.exe with -d in a remote management context.

Windows Registry Set Internet Settings ZoneMap Proxy and Intranet Values

Alerts on Windows ZoneMap registry changes that set proxy/intranet bypass values, using registry set-value telemetry and process image context.

Windows DLL Side-Loading: OleView loading aclui.dll

Alerts on OleView.exe loading aclui.dll on Windows, excluding common benign paths to highlight potential DLL side-loading.

macOS pbpaste Clipboard Read via Process Execution

Flags macOS executions of pbpaste that can expose clipboard contents to stdout for potential data collection.

Windows Security: Changes to "ESX Admins" Domain Group Membership

Alerts on domain group management events involving the "ESX Admins" group name, which may grant privileged access.

Windows File Access to Cryptocurrency Wallet Keystores by Uncommon Processes

Alerts on access to Ethereum/Bitcoin-style wallet files from non-standard processes on Windows.