Every published rule

Windows: Detect Named Pipe Creation with Koh Default Names

Alerts on Windows named pipe creation with Koh default identifiers in the pipe name.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.

Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)

Flags antivirus ransomware detections when the alert signature contains known ransomware family name strings.

Windows Hacktool Execution Flagged by Imphash in Process Creation

Alerts on Windows process executions where the import hash matches known hacktool binaries, even if renamed.

Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender

Alerts on Windows processes launched with DumpStack.log in the image name and command-line output argument.

Grafana Web Path Traversal Exploitation (CVE-2021-43798) With 200 Responses

Alerts on Grafana web requests with traversal patterns in the URI query that return HTTP 200.

Windows PowerShell Process Creation with DInjector Cradle Flags (/am51 and /password)

Identifies Dinject PowerShell cradle usage by matching command-line flags '/am51' and '/password' in Windows process creation.

Windows LSASS Process Clone Execution Observed

Alerts on process creation where LSASS creates a new LSASS clone, which may indicate credential dumping activity.

Windows Process Creation: cmd.exe Spawned from Edge Elevation Service (CVE-2021-41379)

Alerts when cmd.exe or PowerShell spawns under Edge elevation service with SYSTEM integrity, consistent with CVE-2021-41379 exploitation.

Windows MSI Exec Creates elevation_service.exe Under Edge Path (CVE-2021-41379)

Flags msiexec creating elevation_service.exe within the Microsoft Edge application directory, indicating potential LPE exploitation.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.

Linux Network Connection to /bin/bash via Reverse Shell Pattern

Alerts on /bin/bash network connections to non-local destination IPs, consistent with reverse shell behavior.

Linux auditd: Detect processes using --cpu-priority command-line parameter (possible miner behavior)

Alerts on Linux processes whose command line includes --cpu-priority, a common miner CPU tuning flag.

Windows DLL Hijacking via Forced Load of C:\Windows\ADFS\version.dll

Alert on loading C:\Windows\ADFS\version.dll, a DLL hijacking indicator consistent with the FoggyWeb technique.

Zoho ManageEngine ADSelfService Plus CVE-2021-40539 REST API exploit URL access (Web)

Flags web requests targeting ADSelfService Plus REST API paths linked to CVE-2021-40539 authentication bypass.

Microsoft Exchange ProxyToken Exploitation via ECP POST and InboxRules NewObject (CVE-2021-33766)

Flags POSTs to Exchange ECP InboxRules endpoints with SecurityToken= that return HTTP 500, indicating ProxyToken exploitation attempts.

Windows Process Creation Matching TrustedPath UAC Bypass Directory Mocking Strings

Alerts on Windows processes referencing System32/SysWOW64 paths consistent with TrustedPath UAC bypass directory mocking.

MODX Manager Path Traversal Attempt via tvs.php class_key (CVE-2010-5278)

Alerts on HTTP requests to MODx tvs.php with traversal-based class_key payload indicative of LFI attempts.

Web Exploitation of Arcadyan Router Path Traversal and Config Injection Attempts

Detects Arcadyan router exploit traffic by matching URL-encoded path traversal patterns in query strings linked to config injection.