Sigma detection rules, expert-reviewed

Windows Security Event 4656: SAM Registry Hive Key Handle Requested

Flags Windows handle requests to registry keys ending with \SAM using Security EventID 4656.

Cisco AAA keyword hits for data staging and file transfer commands (TFTP/RCP/PUT/COPY/ARCHIVE)

Flags Cisco AAA activity containing TFTP/RCP and copy/archive commands commonly used to stage data on devices.

Cisco AAA Configuration Modification Command Patterns

Flags Cisco AAA command activity that includes keywords for configuration changes like HTTP/HTTPS, KRON, ACLs, and NTP.

Cisco AAA local account and remote authentication changes

Flags Cisco AAA log events showing local username/account changes and remote authentication configuration updates.

Cisco AAA Commands Indicating File Deletion on Local Flash Storage

Flags Cisco AAA log entries referencing flash file erase, delete, or format operations that may indicate stealthy cleanup.

Cisco AAA discovery via show/dir commands

Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.

Cisco IOS AAA Crypto PKI Export/Import Commands

Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Flags Cisco network OS attempts to clear logs or archives via AAA command text.

Cisco AAA configuration changes enabling SPAN/RSPAN monitoring capture

Alerts on Cisco AAA logs referencing SPAN/RSPAN or monitor capture point configuration changes.

Cisco AAA: Detection of 'show history' and 'show logging' command input

Alerts on Cisco AAA command input attempting to view history or logging via 'show history'/'show logging' commands.

Cisco IOS AAA Logging Disabled via 'no logging' and 'no aaa new-model' commands

Flags Cisco AAA command text that includes 'no logging' and/or 'no aaa new-model' to indicate logging being turned off.

Cisco AAA Command Output Collection: show running/startup-config and archive config

Detects Cisco command strings attempting to collect device configuration via show running/startup/archived config.

Uncommon PowerShell HostApplication Values in Windows PowerShell Start Logs

Detects PowerShell classic start events with unusual HostApplication values that may indicate evasion of powershell.exe-focused detections.

Windows CreateRemoteThread with LoadLibraryA likely DLL injection

Alerts on CreateRemoteThread starting LoadLibraryA from kernel32.dll, consistent with DLL injection attempts.

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.