Sigma detection rules, expert-reviewed

Windows Net.exe Network Connections Discovery via Use Sessions Query

Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

Detects PowerShell usage of Get-NetTCPConnection to enumerate TCP network connections.

Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

Windows netsh.exe Firewall Configuration Discovery (show firewall rule/state/name=all)

Flags netsh.exe commands used to enumerate Windows firewall rules and states via “show firewall … name=all”.

Windows: Network connections initiated to api.mega.co.nz or mega.nz

Identifies initiated Windows outbound connections to api.mega.co.nz/mega.nz for potential file-transfer staging.

Windows sc.exe Service Query Execution via Process Creation

Flags sc.exe executions with command lines containing " query", consistent with Windows service information discovery.

Linux auditd: getcap scanning for setuid/setgid-capable files under root

Flags getcap command-line usage scanning / for Linux capability-bearing files via auditd.

macOS: Process commands with trailing space in filename to evade matching

Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Linux dd Command Overwrite or Deletion via of= and input redirection

Flags Linux dd executions that use of= with /dev/zero or /dev/null, consistent with file overwrite or deletion attempts.

Linux Clipboard Data Collection via xclip -sel clip -o

Alerts on Linux processes running xclip to output clipboard content using -sel clip -o.

Linux Cron Directory File Creation via File Events

Flags new Linux cron-related files created under standard cron directories, excluding a few known benign paths.

OneLogin: Detect API user account lock or suspension events

Flags OneLogin API events indicating a user account was locked or suspended.

OneLogin: User Assumes Another Account via Event Type 3

Alerts on OneLogin events indicating a user assumed another user account via event_type_id 3.