Sigma detection rules, expert-reviewed

Windows Process Creation: svchost Running NavShExt.dll Deletion/Setting Commands

Alerts on svchost.exe process commands referencing cached NavShExt.dll deletion and execution markers consistent with Elise backdoor activity.

Linux Auditd: Program Executions from Suspicious Web and Data Directories

Alerts on Linux process creation when the executed binary path begins with commonly abused temp/web/data directories.

Linux auditd: Executing suspicious chmod and cp commands

Triggers on auditd EXECVE events for chmod (777/u+s) and cp overwriting /bin/ksh or /bin/sh.

Windows System Binary Execution From Unusual Location (Process Creation)

Alerts when common Windows system binaries run from an uncommon directory rather than standard system locations.

Web/SQL Application Logs: SQL Error Strings Indicative of Injection Probing

Flags SQL error log messages with injection-probing syntax/quoting/UNION mismatch keywords.

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Flags Windows process creation where EQNEDT32.EXE is the parent, matching CVE-2017-11882 exploitation dropper behavior.

Windows Security Event 4719 Audit Policy Changes indicate Windows auditing disabled

Flags Windows Event Auditing disabled indicators from Security Event ID 4719 with removed success/failure audit policy.

Windows File Events: java.exe in AppData\Roaming\Oracle\bin Path with .exe and .vbs Artifacts

Alerts on Windows file events for suspicious java*.exe placement in AppData\Roaming\Oracle\bin and .vbs files containing "Retrive".

Windows Process Creation: javaw.exe Command Line Indicates Adwind/JRAT Roaming Oracle Path

Flags command-line patterns indicating javaw.exe execution from AppData\Roaming\Oracle with java/.exe markers.

Windows Driver Frameworks: USB Device Plug/Unplug Events (Event IDs 2003, 2100, 2102)

Flags USB device plug/unplug related Driver Frameworks User-Mode events using Windows event IDs 2003, 2100, and 2102.

Proxy Downloads of Executables and Documents from Suspicious Dynamic DNS Domains

Alerts when proxy traffic downloads common executable or document payload types from a curated list of dynamic DNS hostnames.

Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)

Alerts when proxy users download common malware and lure file types from hosts using suspicious TLDs.

Windows Named Pipe Creation Alert for Known Malicious Pipe Names

Alert on Windows named pipe creations where the PipeName matches known malware-associated pipe identifiers.

Windows Named Pipe Creation Matching Suspected Turla Pipe Names

Alert on Windows named pipe creation when the PipeName matches Turla-associated strings.

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).