Sigma detection rules, expert-reviewed

SPN Enumeration Previous to Kerberoasting Attack - Native Commands (via process_creation)

This rule detects retrieve SPN using commandline and native tools.

Malicious Edge Abuse for Payload Download via Console (via process_creation)

This rule detects attemptes to download a payload directly via console.

Obfuscated Certutil Payload Obfuscation - Command (via process_creation)

This rule detects abuse certutil command to download obfuscated malicious payload. Tools like Tchopper can trigger this rule.

Malicious User Account Created by a Computer Account (via security)

This rule detects would abuse some privileges while realying host credentials to escalate privileges.

Malicious Netsh Helper DLL Abuse - Process (via process_creation)

This rule detects abuses the Netsh DLL feature to perform some code execution.

Malicious WMI Registration - PowerShell (via powershell)

This rule detects createsan instance of a WMI class using tools like WMImplant or PowerLurk.

Malicious SQL Server Sqlcmd Utility Abuse for Privilege Escalation (via process_creation)

This rule detects uses sqlcmd utility to escalate privileges or introduce weaknesses.

Malicious User Application Credentials Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.

In-Memory Security Package (SSP) Added - Reg via Command (via process_creation)

This rule detects adds a reference in the registry to a malicious SSP (Security Support Provider). Note that this rule will not work with "in memory" SSP injection (Mimikatz).

Malicious Microsoft Defender Critical Security Components Disabled - PowerShell (via powershell)

This rule detects disable Defender security features in PowerShell.

Malicious Rubeus Kerberos Constrained Delegation Abuse - S4U2Proxy (via security)

This rule detects abuse Kerberos constrained delegation in order to escalate privileges.

Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)

This rule detects dump the LSASS process content using a renamed version of the Procdump tool.

Malicious Impacket SMBexec Service Creation - Registry (via registry_event)

This rule detects register the SMBexec service to estasblish persistence.

Malicious User Creation via Commandline (via process_creation)

This rule detects create a user via commandline.

Malicious Network Share Discovery And/or Connection via Commandline (via process_creation)

This rule detects enumerate or to establish a connection to a network share.