Sigma detection rules, expert-reviewed

macOS split Command Used to Divide Files into Parts

Flags macOS process execution of split, indicating file splitting activity that may support staging or exfiltration.

Linux split Command Used to Divide Files for Possible Exfiltration

Identifies use of the Linux split command to break files into parts, potentially for staging or exfiltration.

macOS Startup Item Plist Created in StartupItems Folders

Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.

Windows te.exe Execution of Test Components (TAEF) via Process Creation

Alerts on process activity involving te.exe, which may indicate TAEF-based execution of malicious test components.

macOS Screen Capture via /usr/sbin/screencapture Process Execution

Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.

macOS GUI Credential Prompt Capture via osascript

Flags osascript command lines that script system dialogs referencing authentication and password-related terms.

Windows Indirect Command Execution via Program Compatibility Assistant pcwrun.exe

Alerts on child processes spawned by pcwrun.exe, indicating indirect command execution via Program Compatibility Assistant.

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

Windows regini.exe Execution Leading to Registry Key Changes

Alerts on Windows executions of regini.exe that can import registry changes from text files.

Windows net.exe Unmount Share (/delete) Execution

Alerts on net.exe/net1.exe commands that include "share" and "/delete", indicating share unmount/removal on Windows.

macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands

Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.

Linux Local Account Enumeration via lastlog, /etc/* file reads, id, and lsof -u

Flags Linux process activity consistent with enumerating local system accounts using /etc account data and related tools.

Linux Password Policy Discovery via chage and passwd Commands

Identifies Linux password policy discovery by running chage/waswo with status arguments and reading common password policy files.

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.