Sigma detection rules, expert-reviewed

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

Linux Process Creation: crontab -l Enumeration

Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.

Linux Wget Writing Files Under /tmp or /var/tmp

Alerts when wget creates files under /tmp or /var/tmp on Linux.

Linux Shell Script Creation in /etc/profile.d/ for Persistence

Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.

Windows DLL Sideloading via SmadHook32c.dll and SmadHook64c.dll Loads

Alerts on non-standard loads of SmadHook32c.dll/SmadHook64c.dll on Windows, consistent with potential DLL sideloading.

Windows: PowerShell Core DLL Loaded by Office Application

Flags Office apps that load System.Management.Automation DLLs associated with PowerShell Core.

Windows: Detect Loading amsi.dll by LOLBIN Processes

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

Windows File Events: PSScriptPolicyTest Script Creation by Uncommon Process

Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.

Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing

Alerts on proxy requests to specific suspect C2-related domains by host substring match.

Suspicious DNS Queries to Operation Triangulation-Like Domains for C2 Beaconing

Detects DNS queries to known Operation Triangulation-related domains that may indicate C2 beaconing.

Windows: Detect w3wp.exe launching csc.exe for Dynamic Compilation (MOVEit CVE-2023-34362)

Flags IIS (w3wp.exe) spawning csc.exe within a MOVEit pool, consistent with dynamic compilation activity.

Windows File Activity Indicators of Potential MOVEit Transfer CVE-2023-34362 Exploitation

Finds MOVEit Transfer webroot file and ASP.NET compilation artifacts on Windows that may indicate CVE-2023-34362 exploitation.

Linux process-created writes to sensitive or critical files via shell redirection or editors

Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.

Webserver: Potential CVE-2023-25717 Ruckus Wireless Admin Injection via Unauthenticated HTTP GET

Alerts on suspicious GET requests to Ruckus Wireless Admin login endpoints containing '$(' payload markers.

Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.