Sigma detection rules, expert-reviewed

Suspicious PowerShell Script Block Invocations Using Encoded/Hidden Execution and Persistence Commands

Flags PowerShell script blocks using hidden/non-interactive execution, encoded/decode patterns, iex execution, web downloads, or run key modifications.

Windows PowerShell Script Block Logging: PSAttack marker string

Alerts when PowerShell script blocks contain the "PS ATTACK!!!" marker on Windows.

Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks

Alerts when PowerShell ScriptBlock text includes strings matching known malicious commandlets from common exploitation toolsets.

Suspicious PowerShell Module Usage with Hidden/Encoded Execution Parameters on Windows

Flags hidden or encoded PowerShell invocations that decode/execute code or download-and-execute patterns, while filtering a Chocolatey installer snippet.

Windows PowerShell Execution via EngineVersion/HostVersion Mismatch in Command Start Telemetry

Detects PowerShell execution attempts that match a specific executable EngineVersion/HostVersion mismatch pattern on Windows.

Windows System Service Execution of Credential Dumping Tools (Service Control Manager Event 7045)

Flags Service Control Manager service creation with ImagePath names tied to credential dumping tools (Event ID 7045).

Windows Security EID 4697 Service Execution of Credential Dumping Tools

Alerts on Event ID 4697 service execution paths containing common credential dumping tool names on Windows.

Windows process access targeting verclsid.exe with Office/VBA shellcode traces

Flags broad access to verclsid.exe from Microsoft Office/VBA contexts with VBE7.DLL call traces consistent with shellcode injection.

Linux Syslog Buffer Overflow Exploit Attempt Keywords

Alerts on Linux syslog entries containing known buffer overflow/stack-smashing attempt keyword patterns.

Linux ClamAV alerts for Trojan, Webshell, Rootkit, Htran, VirTool detections

Detects ClamAV log entries with keyword-based indicators for Trojans, webshells, rootkits, and Htran.

Apache worker crash logs with "Segmentation Fault" exit signal

Alerts on Apache error log lines showing a worker process crashed with an exit signal Segmentation Fault.

Windows LSASS Remote Thread Creation Indicative of Password Dumping

Flags Windows remote thread creation targeting lsass.exe, a common pattern in password dumping activity.

Windows Security Event 4794 Password Change for DSRM Account

Flags potential changes to the DSRM administrator password on Windows domain controllers using Security EventID 4794.

Windows Application Logs: Match Antivirus Signature and Malware Keyword Hits

Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.

Windows Webshell Command Strings in Webserver GET Requests

Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.