Sigma detection rules, expert-reviewed

Windows: WinRAR.exe Application Error Crash on Versions Below 6.23

Flags WinRAR.exe crash events on Windows when the installed version is below 6.23.x.

Windows: Detect WinRAR Creating .rev Files Associated with CVE-2023-40477

Alert on .rev file creation tied to WinRAR/Explorer on Windows as an indicator of potential CVE-2023-40477 exploitation.

Suspicious WinRAR Child Process Execution Attempt on Windows (CVE-2023-38331)

Alerts on WinRAR spawning command/scripting child processes tied to Temp\Rar$ activity consistent with CVE-2023-38331 exploitation attempts.

Windows: WinRAR double-extension file creation with space in Temp Rar$ path

Alerts on WinRAR-created Temp Rar$ files with double extensions separated by a space on Windows.

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.

Windows: Local User Creation via net.exe with DarkGate and SafeMode

Alerts on net.exe adding a local user when the command line includes “DarkGate” and “SafeMode”.

Linux Process Discovery of Container Environment via ls -i on / Directory

Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.

Linux Docker Container Discovery via .dockerenv File Listing or Reads

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise

Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.

Windows File Creation of wermgr.exe in Uncommon Directory (Potential CVE-2023-36874)

Alerts on wermgr.exe creation in atypical Windows directories that may indicate filename spoofing.

Windows: Report.wer File Created in Uncommon WER ReportArchive Subfolders

Alerts on Report.wer creation under WER ReportArchive paths that don’t match common subfolder patterns.

Windows Process Watch: PythonFunctionWarnings Disabled via Excel Security Registry Setting

Flags Excel-related process command lines that disable Python function execution warnings via PythonFunctionWarnings=0.

macOS: In-Memory Download and Compile via curl and osacompile in a Single Command

Alerts when macOS processes include both curl and osacompile, consistent with downloading and compiling payloads.

macOS: JAMF CLI (jamf) execution for account and MDM management

Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.