Sigma detection rules, expert-reviewed

Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers

Detects suspicious GlobalProtect device telemetry file creations with filenames containing CVE-2024-3400 command-injection indicators.

Windows Registry Set: Custom Protocol Handler DLL for CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345}

Alerts when a Windows registry entry for a specific custom protocol handler CLSID is set to a DLL.

Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity

Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.

Windows JavaScript file creation in DriverStore FileRepository

Alerts on creation of .js files under DriverStore\FileRepository based on the target path in Windows file events.

Windows File Creation: ProgramData Persistence Artifacts Matching

Alerts on Windows file creations in C:\ProgramData matching specific driver inf, .dll, and batch/script filename patterns.

Suspicious Palo Alto GlobalProtect Session Unmarshal Path Traversal and Command Injection Attempts

Detects GlobalProtect logs with directory traversal/command injection-style indicators tied to CVE-2024-3400 behavior.

Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code

Alert on Duo successful MFA logins that are attributed to bypass-user codes.

Linux Pnscan Binary Data Transfer via Command-Line

Flags Linux executions with Pnscan-like arguments indicating binary send/receive data transfer.

Windows DLL side-loading: KeyScramblerIE.DLL loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.

Kubernetes API Audit: Unauthorized (401) or Forbidden (403) Access Attempts

Alerts on Kubernetes API audit events returning 401 or 403, indicating authentication or authorization failures.

Linux sshd Spawns Root Shell Script Commands Suggesting CVE-2024-3094 Exploitation

Alerts on sshd spawning bash/sh one-liners as root, a potential indicator of CVE-2024-3094 style exploitation.

Azure AD Audit: Trusted Root CA Added for Passwordless Certificate Authentication

Alerts on Azure AD changes that add a new trusted root CA for passwordless certificate-based authentication.

Azure AD Audit Logs: Certificate-based authentication enabled via AuthenticationMethodsPolicy update

Flags Azure AD audit log events where the Authentication Methods policy is updated to enable certificate-based authentication.

Kubernetes Audit: Sidecar Injection via kubectl patch to Deployments

Detects PATCH operations against Kubernetes Deployments that may indicate sidecar-style container injection.

Kubernetes Service Account Created via Audit Log

Alerts on Kubernetes audit events showing new ServiceAccounts created.