Sigma detection rules, expert-reviewed

Web exploitation attempts for CVE-2023-43261 causing info disclosure in Milesight routers

Alerts on successful GET requests for /lang/log/httpd.log in Milesight router web access logs, consistent with CVE-2023-43261 disclosure attempts.

Potential Information Disclosure via CVE-2023-43261 in Milesight Router Proxy Logs

Alerts on HTTP GET 200 responses for UR router log paths in proxy requests associated with CVE-2023-43261.

Cisco IOS XE Web UI Exploitation Indicators for CVE-2023-20198 via Syslog Login and Config Events

Matches Cisco IOS XE Web UI and web login success logs consistent with CVE-2023-20198 exploitation using specified admin/TAC usernames.

Windows Task Manager Creating lsass.dmp in Temp

Alerts when Task Manager creates a Temp lsass .DMP file consistent with LSASS memory dumping.

Windows PowerShell EnableScripts Policy Enabled via Registry DWORD

Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).

Windows Process Execution: curl.exe Downloading Files From an IP URL

Flags curl.exe commands that download via an IP-based URL using output/remote-name flags.

Windows CertOC.exe Downloads File From IP-Based URL Using -GetCACAPS

Flags CertOC.exe executions using an IP-based URL in the command line with -GetCACAPS.

Windows DLL Sideloading via ImageLoad of mscoRee/colorui/mapistub/HID payload DLLs

Alerts on Windows processes loading DLLs from targeted ProgramShared/ProgramData paths consistent with DLL sideloading.

Windows rundll32.exe calling DllRegisterServer from a non-standard DLL path

Detects rundll32.exe calling DllRegisterServer from command lines associated with non-standard DLL locations.

Windows regsvr32.exe Silent DLL execution invoking DllRegisterServer from uncommon paths

Alerts on regsvr32.exe /s /e executions of DLLs from potentially suspicious locations that may trigger DllRegisterServer.

DarkGate-related Autoit3.exe execution with suspicious parent process (Windows)

Alerts on AutoIt3.exe execution when spawned from cmd.exe, KeyScramblerLogon.exe, or msiexec.exe, excluding common legitimate install paths.

Windows Autoit3.exe Created by Uncommon Process (curl.exe/KeyScramblerLogon.exe/etc.)

Alerts on Windows events where Autoit3.exe is created, with the producing process matching curl.exe or other uncommon executables.

Windows Process Creation: CoercedPotato.exe Execution via ExploitId Parameters

Flags Windows process creation for CoercedPotato.exe with --exploitId and known IMPHASH values.

Windows Named Pipe Creation with "\coerced\" PipeName Segment

Detects Windows named pipe creations where the pipe name contains the '\coerced\' pattern.

Windows MSSQL Failed Logon (EventID 18456) From External Client IP

Alerts on MSSQL failed login attempts (Event 18456) from client IPs outside typical local/private ranges.