Sigma detection rules, expert-reviewed

Windows Process Creation: Cobalt Strike module/command strings entered in cmd.exe

Alerts when cmd.exe command lines include Cobalt Strike module/command strings.

Windows Process Command Line: Accidental Cobalt Strike Commands in cmd.exe

Flags cmd.exe executions whose command lines include known Cobalt Strike command terms.

Windows Raspberry Robin Execution via cmd.exe Parent and External-File Payload

Flags cmd.exe with /r from external media launching msiexec.exe /q that includes an HTTP/HTTPS payload URL.

Windows: Raspberry Robin Command Execution via fodhelper.exe and rundll32/regsvr32

Flags Windows process-spawn chains where fodhelper.exe runs rundll32/regsvr32 with Raspberry Robin-style command-line patterns.

Windows Process Creation: Suspicious Child Processes Spawned by regsvr32.exe

Alerts when regsvr32.exe spawns suspicious child processes like PowerShell, mshta, or scripting utilities.

Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc

Detects rundll32.exe launching davclnt.dll DavSetCookie with HTTP and spoolss/srvsvc pipe parameters associated with NTLM coercion.

Linux: Detects Nimbuspwn-related exploit strings targeting CVE-2022-29799/CVE-2022-27800

Detects Linux keyword patterns suggesting Nimbuspwn-style traversal attempts via networkd-dispatcher error handling.

Windows Registry: Service configured with image path in suspicious public/temp folders

Detects Windows service ImagePath pointing to Users\Public, Perflogs, ADMIN$, or Temp based on registry_set events.

Windows: PrintBrm.exe ZIP extraction or creation via command-line parameters

Flags PrintBrm.exe executions that include '-f' and '.zip', consistent with ZIP creation or extraction behavior.

Windows svchost.exe RDP (3389) Connections to HTTP/HTTPS Ports 80 or 443

Alerts when svchost.exe initiates from TCP 3389 to destination ports 80 or 443, consistent with possible RDP tunneling over web ports.

Windows: Detect ngrok Traffic Forwarded to Local RDP Port via TerminalServices Logs

Detects suspicious ngrok usage that forwards to the local RDP port using Windows TerminalServices-LocalSessionManager EventID 21.

Windows: rundll32.exe spawning explorer.exe child process (shell32.Control_RunDLL)

Alerts on rundll32.exe spawning explorer.exe, an uncommon child process pattern that may indicate stealthy execution via shell components.

Windows Process Creation: KrbRelay.exe Kerberos Relay Tool Execution

Flags Windows process creation for KrbRelay.exe with Kerberos relaying-related command-line arguments.

Windows Hacktool Execution via PE Metadata Company Field

Flags execution of Windows binaries with PE Company metadata set to "Cube0x0", even when renamed.

Windows UAC Bypass via Event Viewer RecentViews File Creation

Alerts on suspicious file events to Event Viewer RecentViews paths that may indicate a Windows UAC bypass attempt.