Sigma detection rules, expert-reviewed

BITS Payload Downloaded via Commandline (via process_creation)

This rule detects downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.

Suspicious Group Discovery - Command (via process_creation)

This rule detects enumerate local or domain groups via commandline.

Malicious SQL Server Dedicated Admin Connection (DAC) Suspicious Activity (via application)

This rule detects enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

Malicious Service Deactivation - Command (via process_creation)

This rule detects disable.

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

This rule detects enable or reconfigure BitLocker on multiple hosts for ransomware purposes.

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

This rule detects sSH brutforce a Windows OpenSSH server with non existing users.

Malicious Massive Remote Service Creation via Named Pipes - Tchopper (via security)

This rule detects uses the Tchopper tool by remotely creating multiple services via named pipes.

Malicious Audit Policy Disabled by Command Line (via process_creation)

This rule detects disbale or clear the audit policy for defense evasion purposes.

Malicious Shared Folder Access with Forged Golden Ticket (via security)

This rule detects used a forged Golden ticket to login on a remote shared folder. Per default or if specified, the ticket will be forged using the builtin administrator account (SID *-500). However, and it frequent cases, a non suspicious user name will be specificied during the forge in order to evade security monitoring. The rule works based on this trick.

Malicious User Files Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump user profile information via network share.

Malicious LSASS Credential Dump with LSASSY - Kernel Access (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

SystemNightmare by GentilKiwi - External Printer Mapped - CVE-2021-1675 / CVE-2021-34527 (via security)

This rule detects exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi.

Obfuscated RDP Tunneling Configuration Enabled for Port Forwarding (via process_creation)

This rule detects configure port forwarding on a host to redirect traffic to a C&C target.

Malicious Metasploit Reverse Shell Injection in SQL Server (via process_creation)

This rule detects inject a payload into SQL Server in order to obtain a remote shell.

Malicious Impacket WMIexec Process Execution (via process_creation)

This rule detects execute WMIexec in order to escalate privileges.