Sigma detection rules, expert-reviewed

IFM Creation Detected from Commandline - Installation from Media (via process_creation)

This rule detects create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.

Suspicious Lateral Movement by Mounting a Network Share - Net Use - Command (via security)

This rule detects move laterally by mounting a network share using compromised user credentials.

Malicious Impacket DCOMexec Privilege Abuse via MMC (via security)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Obfuscated Encoded PowerShell Payload Deployed via Process Execution (via process_creation)

This rule detects deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Suspicious Windows Native Pktmon Sniffer Abuse (via process_creation)

This rule detects use the Windows sniffer Pktmon in order to capture sensitive information or credentials.

OpenSSH Server Listening on Socket (via openssh)

This rule detects enables the OpenSSH server and server starts to listening on SSH socket.

BITS Payload Downloaded via PowerShell (via powershell)

This rule detects downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

This rule detects wMIimplant.

Obfuscated Encoded PowerShell Payload Deployed - PowerShell (via powershell)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload.

Malicious Scheduled Task Created and Deleted Fastly - ATexec.py (via security)

This rule detects abuse task scheduler capacities to execute commands or elevate privileges.

SharpHound Host Enumeration Over Kerberos (via security)

This rule detects detect if a source host is requesting multiple Kerberos Service tickets (TGS) for different assets in a short period of time.

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

This rule detects clear the event logs.

DoT (DNS Over TLS) Activation - Command (via process_creation)

This rule detects enable DNS over TLS in order to evade detection for command and control purposes.

Suspicious System Time Changed (via security)

This rule detects change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.

Suspicious Success Login Attempt on a Windows OpenSSH Server (via security)

This rule detects connect to a Windows host using the SSH protocol.