Sigma detection rules, expert-reviewed

Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

Alerts on Linux execve events launching zip, gzip (-k), or tar create commands often used to compress data.

PowerShell Compress-Archive Cmdlet Execution for Data Compression

Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.

Linux Service Reload/Start via systemctl or service Command Execution

Identifies Linux process executions invoking service control commands with start or reload keywords.

Linux auditd: chmod/chown process execution indicating file or folder permission changes

Flags Linux EXECVE events running chmod or chown, which commonly correspond to file/folder permission changes.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Cisco AAA keyword hits for data staging and file transfer commands (TFTP/RCP/PUT/COPY/ARCHIVE)

Flags Cisco AAA activity containing TFTP/RCP and copy/archive commands commonly used to stage data on devices.

Cisco AAA discovery via show/dir commands

Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.

Cisco AAA Command Output Collection: show running/startup-config and archive config

Detects Cisco command strings attempting to collect device configuration via show running/startup/archived config.

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Flags Windows telemetry indicating a remote PowerShell session startup using wsmprovhost.exe with a specified host parameter.

Windows Image Load: WMI DLLs Loaded by Uncommon Process

Alert on loading of common WMI DLLs by processes outside typical system/.NET paths.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Firewall Rule Accepting Cleartext Protocol Ports

Alerts on firewall-allowed traffic to common service ports that may carry credentials over unencrypted channels.

Cleartext Authentication via Netflow to Common Service Ports

Alerts on Netflow flows to specific service ports that may indicate cleartext protocol use and potential credential exposure.

Qualys: Alert When Firewall Product Is Not Detected on a Host

Alerts when Qualys reports a host missing a detectable firewall product during vulnerability management scanning.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.