Sigma detection rules, expert-reviewed

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

This rule detects clear the event logs.

DoT (DNS Over TLS) Activation - Command (via process_creation)

This rule detects enable DNS over TLS in order to evade detection for command and control purposes.

Suspicious System Time Changed (via security)

This rule detects change the system time to evade defense. Check also if NewTime is different from PreviousTime to reduce false positives.

Suspicious Success Login Attempt on a Windows OpenSSH Server (via security)

This rule detects connect to a Windows host using the SSH protocol.

SPN Enumeration Previous to Kerberoasting Attack - Native Commands (via process_creation)

This rule detects retrieve SPN using commandline and native tools.

Suspicious Modification of a Sensitive Group Policy - GPO (via security)

This rule detects will attempt to take control over a group policy.

Malicious Edge Abuse for Payload Download via Console (via process_creation)

This rule detects attemptes to download a payload directly via console.

Obfuscated Certutil Payload Obfuscation - Command (via process_creation)

This rule detects abuse certutil command to download obfuscated malicious payload. Tools like Tchopper can trigger this rule.

Malicious User Account Created by a Computer Account (via security)

This rule detects would abuse some privileges while realying host credentials to escalate privileges.

Malicious Netsh Helper DLL Abuse - Process (via process_creation)

This rule detects abuses the Netsh DLL feature to perform some code execution.

Malicious WMI Registration - PowerShell (via powershell)

This rule detects createsan instance of a WMI class using tools like WMImplant or PowerLurk.

Malicious SQL Server Sqlcmd Utility Abuse for Privilege Escalation (via process_creation)

This rule detects uses sqlcmd utility to escalate privileges or introduce weaknesses.

Malicious User Application Credentials Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.

NTFS Hard Link Creation (via process_creation)

This rule detects create a hard link.

In-Memory Security Package (SSP) Added - Reg via Command (via process_creation)

This rule detects adds a reference in the registry to a malicious SSP (Security Support Provider). Note that this rule will not work with "in memory" SSP injection (Mimikatz).