Sigma detection rules, expert-reviewed

MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)

Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

macOS launchctl Execution of Launch Agent/Daemon

Flags launchctl usage on macOS to submit, load, or start Launch Agents/Daemons, a common persistence mechanism.

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.

Windows Registry: UAC PromptOnSecureDesktop Disabled

Detects setting UAC PromptOnSecureDesktop to 0 via Windows registry policy, disabling secure desktop for UAC prompts.

Windows Registry: UAC notification disabled via UACDisableNotify set to DWORD 0x00000001

Alerts on registry changes that disable UAC notifications by setting UACDisableNotify to 0x00000001 on Windows.

Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit

Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.

Windows Process: File Recovery from Backup via wbadmin.exe

Flags wbadmin.exe executions that perform file recovery from backups based on recoveryTarget and itemtype:File arguments.

Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files

Alerts on wbadmin.exe backup commands that reference SAM/SECURITY/SYSTEM hives or NTDS.DIT.

Windows Firewall Allow Rule Added via WmiPrvSE.exe

Flags Windows firewall allow-rule additions where WmiPrvSE.exe is the modifying application.

Proxy WebDAV MiniRedir Drives Execution from External Shares

Alert on external WebDAV MiniRedir GET requests for executable-like file extensions that may lead to execution.

Linux network connections to known malware callback ports

Alerts on initiated Linux outbound connections to specific known suspicious destination ports, excluding local/private IP ranges.

Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule

Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.

Unusual Access to Windows Outlook Unistore Mail Data by Non-Standard Processes

Alerts when unusual processes access Outlook Unistore (data and UnistoreDB store.vol) file locations on Windows.

PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule

Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.