Sigma detection rules, expert-reviewed

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

Potential BearLPE Exploitation via Windows Task Scheduler schtasks.exe DACL Change

Flags schtasks.exe executions with /change, /TN, /RU, and /RP, consistent with task modification tied to BearLPE attempts.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

Windows Registry: Create/Modify CLSID/AppX keys associated with OceanLotus decoy paths

OceanLotus Registry Activity

Windows: Suspicious Service Installation via Registry ImagePath Outside system32

Alerts on NalDrv/PROCEXP152 service ImagePath registry entries configured outside the expected system32 driver path.

Windows Suspicious PROCEXP152.sys Creation in Local Temp Folder

Flags creation of PROCEXP152.sys in AppData\Local\Temp, excluding events from common Sysinternals executables.

Windows Security Event 4673: SeLoadDriverPrivilege Use by Non-Whitelisted Processes

Flags Windows Event 4673 instances where SeLoadDriverPrivilege is exercised, suggesting attempts to load or unload kernel-mode drivers.

Linux Command Lines Creating Symlink to /etc/passwd

Alerts on Linux command lines attempting to create symlinks to /etc/passwd via ln -s/ln -f patterns.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows Security 5145 Network Share Access to Sensitive File Extensions

Alerts when Windows users access network-shared files with extensions commonly targeted for credential or data collection.