Sigma detection rules, expert-reviewed

Windows Security: Account Encryption/Preauth/Delegation Flags Weakened in User Account Changes

Flags Windows Event ID 4738 user account changes that enable weaker encryption or related pre-auth behavior.

Windows Security: SeEnableDelegationPrivilege Enabled via AD User Right (Event 4704)

Alerts when Event ID 4704 assigns SeEnableDelegationPrivilege, enabling control over other AD user objects.

Windows rundll32 execution matching ZxShell function and remote disk strings

Alerts on rundll32.exe command lines containing zxFunction and RemoteDiskXXXXX indicative of ZxShell execution.

Suspicious Malformed User-Agent Strings in Proxy Logs

Flags proxy requests whose User-Agent headers are malformed or match suspicious automation/tooling patterns, excluding known Adobe/Acrobat traffic.

Suspicious Malware User-Agent Strings in Proxy Logs

Alerts on proxy traffic with user-agent values and substrings commonly seen in malware communications.

Proxy logs: Detect suspicious hack tool user agents from known scanning and SQLi tools

Alerts on proxy requests with User-Agent values commonly used by scanners and hack tools, indicating automated probing or exploitation attempts.

Proxy logs: suspicious exploit framework User-Agent strings

High-severity match on proxy User-Agent strings commonly seen in exploit/pentest frameworks.

Proxy HTTP Requests with Empty User-Agent Header

Flags proxy HTTP traffic with an empty User-Agent header, which may indicate automation or unusual client behavior.

Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts

Looks for specific vsftpd error strings that may indicate exploitation-triggered faults or abnormal request handling.

Linux SSHD Logs: Suspicious OpenSSH Daemon Error Keywords

Alerts on sshd log entries with specific OpenSSH fatal or cryptographic error messages indicating suspicious access attempts.

Windows Security Events Indicating File Deletion Attempts Using SDelete Extensions

Alerts on Windows security file access events for object names ending in .AAA or .ZZZ, consistent with secure deletion behavior.

Windows WCE wceaux.dll File Access via Security Event 4656/4663

Identifies Windows Security event activity involving access to the wceaux.dll library file.

Windows PsExec Service Execution via PSEXESVC.exe

Detects PsExec service execution by matching the PSEXESVC.exe process on Windows.

Windows: PsExec Service File Creation via PSEXESVC.exe Written to Disk

Flags Windows file creation of \PSEXESVC.exe, indicating potential PsExec service deployment for remote execution.

Windows PsExec Service Installation via Service Control Manager (Event ID 7045)

Flags Service Control Manager Event ID 7045 when a PSEXESVC service is installed with ImagePath ending in \PSEXESVC.exe.