Sigma detection rules, expert-reviewed

AWS CloudTrail: ElastiCache Cache Security Group Created

Flags CloudTrail events indicating a new ElastiCache cache security group was created.

AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount

Alerts on Route 53 domain transfer requests in CloudTrail when a domain is moved to another AWS account.

AWS Route 53 Domain Transfer Lock Disabled via CloudTrail

Alerts when Route 53 domain transfer protection is removed through DisableDomainTransferLock events in CloudTrail.

Windows Security: Detect Scheduled Task Deletion (EventID 4699)

Flags Windows scheduled task deletions from Security EventID 4699 while excluding common MRT and Firefox-related tasks.

Linux Remote System Discovery via arp and ping Process Execution

Flags Linux arp or ping commands with LAN/loopback/link-local IP range arguments consistent with remote host discovery.

macOS Network Service Enumeration via nc, netcat, nmap, or telnet

Flags macOS executions of nc/netcat, nmap, or telnet consistent with local or remote service enumeration.

Linux: Process Execution of Network Scanning and Recon Tools

Flags Linux process executions of common network scanning/recon utilities based on executable name (and netcat listen flag filtering).

Linux auditd: Network service enumeration via telnet, nmap, or netcat

Alerts when telnet/nmap/netcat-style binaries are executed on Linux via auditd, consistent with service discovery scanning.

Windows Event Log Detects Volume Shadow Copy Mounts (HarddiskVolumeShadowCopy, EventID 98)

Alerts when NTFS logs indicate a VSS (HarddiskVolumeShadowCopy) mount using EventID 98.

macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine

Flags macOS xattr usage that deletes the com.apple.quarantine extended attribute, consistent with a Gatekeeper bypass attempt.

macOS Base64 Utility Decoding Command Activity

Flags macOS base64 decoding by detecting /usr/bin/base64 runs with the -d argument.

Linux System Network Connections Discovery via who, w, last, lsof, or netstat

Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.

Linux process discovery via grep/egrep searching for security software strings

Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.

Linux Base64 Utility Decoding with -d/--decode in Process Creation

Identifies Linux base64 decoding activity using base64 with the -d/--decode flag.

Windows RunOnce Execution via runonce.exe With AlternateShellStartup and /r

Alerts on runonce.exe executing with /AlternateShellStartup and /r, consistent with configured RunOnce persistence behavior.