Sigma detection rules, expert-reviewed

macOS pbpaste Clipboard Read via Process Execution

Flags macOS executions of pbpaste that can expose clipboard contents to stdout for potential data collection.

Windows Security: Changes to "ESX Admins" Domain Group Membership

Alerts on domain group management events involving the "ESX Admins" group name, which may grant privileged access.

Windows File Access to Cryptocurrency Wallet Keystores by Uncommon Processes

Alerts on access to Ethereum/Bitcoin-style wallet files from non-standard processes on Windows.

GitHub Audit: SSH Certificate Authority Created or SSH Certificate Requirement Disabled

Alerts on GitHub audit log events that create SSH certificate authorities or disable SSH certificate requirements.

GitHub Audit Log: Repository or Organization Transfer Detected

Alerts on GitHub audit log events for repository or organization transfers between environments/accounts.

GitHub Audit Logs: Private/Internal Forking Policy Enabled or Cleared

Alerts on GitHub audit log policy changes that enable or clear forking of private and internal repositories.

Windows: Uncommon Process Access to Chromium User Data Cookies and History

Alerts on uncommon executables reading Chromium cookies/history/web data on Windows, excluding common system and installer paths.

Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Alert on remote thread creation where cmd.exe or PowerShell.exe is the initiating process, excluding common system and Defender sources.

Windows Process Chain Involving Notepad++ Launched via RDPInit and Executed Through CMD

Alerts on rdpinit.exe -> notepad++.exe -> cmd.exe process chain consistent with interactive command execution.

Windows Process Creation: net.exe or PowerShell creating AD group "ESX Admins"

Alerts on net.exe or PowerShell attempts to create a domain group named "ESX Admins" via AD/command-line parameters.

Windows Process Creation Ending in .exe With No Image Name

Flags Windows process creation events where the .exe path exists but the image name is missing, indicating possible stealth or evasion.

Windows: Detect execution of renamed BOINC.exe binary

Flags renamed BOINC executables on Windows by matching OriginalFileName=BOINC.exe when the executed image name differs.

PowerShell Launch With --headless From Conhost.exe on Windows

Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.

Windows Child Process Spawned from conhost.exe with --headless

Alerts when conhost.exe launches a child process using the --headless flag.

Windows Process Execution with 'University of California, Berkeley' Description

Alerts on Windows process creation events whose Description contains "University of California, Berkeley."