Sigma detection rules, expert-reviewed

Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit

Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.

Windows Process: File Recovery from Backup via wbadmin.exe

Flags wbadmin.exe executions that perform file recovery from backups based on recoveryTarget and itemtype:File arguments.

Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files

Alerts on wbadmin.exe backup commands that reference SAM/SECURITY/SYSTEM hives or NTDS.DIT.

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Flags Windows firewall allow-rule additions where WmiPrvSE.exe is the modifying application.

Proxy WebDAV MiniRedir Drives Execution from External Shares

Alert on external WebDAV MiniRedir GET requests for executable-like file extensions that may lead to execution.

Linux network connections to known malware callback ports

Alerts on initiated Linux outbound connections to specific known suspicious destination ports, excluding local/private IP ranges.

Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule

Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.

Unusual Access to Windows Outlook Unistore Mail Data by Non-Standard Processes

Alerts when unusual processes access Outlook Unistore (data and UnistoreDB store.vol) file locations on Windows.

PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule

Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.

Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)

Alerts on outbound connections started by Windows dialer.exe, excluding common local and reserved IP ranges.

Windows Process Creation: SoftPerfect netscan.exe Network Scanner Execution

Alerts on execution of SoftPerfect Network Scanner (netscan.exe), a potential network reconnaissance tool.

Windows RegAsm.exe Initiates Network Connection to Public IP

Alerts on RegAsm.exe initiating outbound connections to public (non-local/private) IP addresses.

Windows: .pth Python Path Configuration File Created in site-packages or venv

Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.

macOS Python Site-Packages .pth File Creation

Alerts on new .pth files created under macOS Python site-packages, a mechanism that can execute code at Python startup.

Linux: Detect Python .pth Path Configuration File Creation in site-packages

Alerts on creation of Python .pth files in /lib/python3.X/site-packages on Linux, which can trigger code at Python startup.