Sigma detection rules, expert-reviewed

Windows Process Creation: BCP.EXE Used to Export SQL Data

Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.

Azure AD Audit: Update User Risk and MFA Registration Policy

Flags Azure AD audit events showing updates to user risk and MFA registration policy.

macOS Process Creation: hdiutil Used to Attach or Mount Disk Images

Flags hdiutil usage on macOS when command lines indicate disk image attachment or mounting.

macOS hdiutil Disk Image Creation via Process Execution

Flags macOS executions of hdiutil with the 'create' option, consistent with disk image creation.

Windows Process Masquerading as svchost.exe via Binary Name and Location

Alerts on svchost.exe-named processes launched from non-standard paths with OriginalFileName svchost.exe.

Windows Rundll32 Execution of Ammy Admin Agent DLL

Identifies rundll32 executions that invoke the Ammy Admin agent DLL with a run parameter on Windows.

Windows: cmd.exe Launched by AnyViewer Agent (AVCore.exe)

Alerts when AnyViewer’s AVCore.exe launches cmd.exe with -d in a remote management context.

Windows Registry Set Internet Settings ZoneMap Proxy and Intranet Values

Alerts on Windows ZoneMap registry changes that set proxy/intranet bypass values, using registry set-value telemetry and process image context.

Windows DLL Side-Loading: OleView loading aclui.dll

Alerts on OleView.exe loading aclui.dll on Windows, excluding common benign paths to highlight potential DLL side-loading.

macOS pbpaste Clipboard Read via Process Execution

Flags macOS executions of pbpaste that can expose clipboard contents to stdout for potential data collection.

Windows Security: Changes to "ESX Admins" Domain Group Membership

Alerts on domain group management events involving the "ESX Admins" group name, which may grant privileged access.

Windows File Access to Cryptocurrency Wallet Keystores by Uncommon Processes

Alerts on access to Ethereum/Bitcoin-style wallet files from non-standard processes on Windows.

GitHub Audit: SSH Certificate Authority Created or SSH Certificate Requirement Disabled

Alerts on GitHub audit log events that create SSH certificate authorities or disable SSH certificate requirements.

GitHub Audit Log: Repository or Organization Transfer Detected

Alerts on GitHub audit log events for repository or organization transfers between environments/accounts.

GitHub Audit Logs: Private/Internal Forking Policy Enabled or Cleared

Alerts on GitHub audit log policy changes that enable or clear forking of private and internal repositories.