Sigma detection rules, expert-reviewed

Proxy WebDAV MiniRedir Drives Execution from External Shares

Alert on external WebDAV MiniRedir GET requests for executable-like file extensions that may lead to execution.

Linux network connections to known malware callback ports

Alerts on initiated Linux outbound connections to specific known suspicious destination ports, excluding local/private IP ranges.

Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule

Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.

Unusual Access to Windows Outlook Unistore Mail Data by Non-Standard Processes

Alerts when unusual processes access Outlook Unistore (data and UnistoreDB store.vol) file locations on Windows.

PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule

Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.

Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)

Alerts on outbound connections started by Windows dialer.exe, excluding common local and reserved IP ranges.

Windows Process Creation: SoftPerfect netscan.exe Network Scanner Execution

Alerts on execution of SoftPerfect Network Scanner (netscan.exe), a potential network reconnaissance tool.

Windows RegAsm.exe Initiates Network Connection to Public IP

Alerts on RegAsm.exe initiating outbound connections to public (non-local/private) IP addresses.

Windows: .pth Python Path Configuration File Created in site-packages or venv

Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.

macOS Python Site-Packages .pth File Creation

Alerts on new .pth files created under macOS Python site-packages, a mechanism that can execute code at Python startup.

Linux: Detect Python .pth Path Configuration File Creation in site-packages

Alerts on creation of Python .pth files in /lib/python3.X/site-packages on Linux, which can trigger code at Python startup.

Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers

Detects suspicious GlobalProtect device telemetry file creations with filenames containing CVE-2024-3400 command-injection indicators.

Windows Registry Set: Custom Protocol Handler DLL for CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345}

Alerts when a Windows registry entry for a specific custom protocol handler CLSID is set to a DLL.

Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity

Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.

Windows JavaScript file creation in DriverStore FileRepository

Alerts on creation of .js files under DriverStore\FileRepository based on the target path in Windows file events.