Every published rule

Suspicious Windows Process Execution of gatherNetworkInfo.vbs via Cscript/Wscript

Alerts on Windows executions referencing gatherNetworkInfo.vbs in process command lines, indicative of potential discovery activity.

Windows: Suspicious Outlook VbaProject.OTM Macro File Created

High-confidence file creation alert for Microsoft\Outlook\VbaProject.OTM while excluding outlook.exe.

Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts

Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.

macOS OSACompile Run-Only Script Execution

Flags osacompile commands on macOS using run-only (-x) with inline script (-e) execution.

macOS Office Apps Spawning Shell or Scripting Processes

Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.

macOS JXA In-Memory Execution via osascript JavaScript eval and NSData URL loading

Detects osascript-launched in-memory JXA JavaScript execution patterns using eval and URL-based data loading.

Linux process copying passwd or shadow from /tmp

Alerts on Linux cp commands that copy /tmp-based passwd or shadow files.

Windows PowerShell Base64-Encoded WMI Class Invocation

Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.

GitHub Audit: High-Risk Security Controls Disabled

Alerts when GitHub audit logs show advanced security, OAuth restrictions, or 2FA requirements disabled for orgs or repos.

GitHub Audit: Dependabot Alerts and Security Updates Disabled

Flags GitHub audit events where Dependabot alerts or security updates are disabled for an organization or repositories.

Linux: Alert on bpf_probe_write_user BPF helper warning strings

Alerts on Linux log messages referencing the bpf_probe_write_user helper warning string, indicating potential suspicious eBPF usage.

Windows PowerShell Module Execution Matches Known Offensive PoshModule Script Names

Alerts on Windows PowerShell module executions where the script context matches known offensive PowerShell script/module names.

Windows: Detect Aruba Netsvc DLL Search Order Hijacking via arubanetsvc.exe Loaded DLLs

Flags arubanetsvc.exe loading targeted DLLs outside standard system paths, suggesting possible DLL search order hijacking.

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Detects rundll32 executions that reference DLLs stored in Alternate Data Streams via ADS-style paths.

Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact

Alerts on creation of PsExec key files in C:\Windows\PSEXEC-*.key, indicating remote execution activity.

Windows Process Creation: svchost DHCPServer RCE Exploitation Attempt

Alerts on svchost.exe running as Network Service with -k DHCPServer, suggesting a potential pre-auth Windows RCE attempt.

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Alerts on PowerShell module payloads containing commandlet/function names from known malicious exploitation and post-exploitation frameworks.

Detect CentOS Web Panel POST login reverse-shell RCE attempts (CVE-2022-44877)

Alert on POST requests to CentOS Web Panel login that contain command-execution and reverse-shell style query parameters.

Windows: driverquery.exe Usage for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Flags successful Windows SMB (LogonType 3) logons from non-private, non-local source IP addresses.