Sigma detection rules, expert-reviewed

Linux: Detect execution of tcpdump or tshark with interface (-i) capture option

Alerts on tcpdump or tshark executions on Linux where an interface flag is present, consistent with network sniffing.

Linux Masquerading via crond Path Using cp Launching /bin/sh

Alerts on Linux execve where cp runs through /bin/sh and the argument ends with /crond, indicating potential masquerading.

Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

Alerts on Linux execve events launching zip, gzip (-k), or tar create commands often used to compress data.

PowerShell Compress-Archive Cmdlet Execution for Data Compression

Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.

Windows Process Creation: Suspicious Command-Line Parameters for 7-Zip/RAR Executables

Detects 7z/rar executions on Windows with suspicious switches like password and delete options.

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Alerts on Linux process command lines containing ' -u#' indicative of sudo CVE-2019-14287 exploitation attempts.

Linux sudo CVE-2019-14287 exploit attempt via unusual USER strings

Alerts on sudo events with USER values matching patterns linked to CVE-2019-14287 exploit attempts.

Windows Process Creation: Suspicious CHCP Code Page Switch to Rare Locale

Alerts on suspicious chcp.com usage that switches Windows code pages to specific rare identifiers in process creation logs.

Windows Registry: Suspicious Keyboard Layout Preload in User Session

Detects user-hive registry changes that preload Persian (Iranian) or Vietnamese keyboard layouts under Windows.

Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution

Flags psr.exe launched with /start or -start, indicating potential user screen and click recording.

Windows OpenWith.exe Launches Another Binary via /c

Flags Windows OpenWith.exe executions that include '/c', indicating it launched another binary.

Windows Devtoolslauncher.exe LaunchForDeploy Executes a Specified Binary

Alerts when devtoolslauncher.exe runs with LaunchForDeploy, indicating it may launch another binary on Windows.

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.