Sigma detection rules, expert-reviewed

Windows: New Notepad++ plugins DLL written outside gup.exe

Alerts on creation of Notepad++ plugin DLLs by a process other than gup.exe, suggesting possible persistence via custom plugins.

Windows BITS Client Job Downloads From Uncommon Remote TLDs

Alerts on BITS transfers (EventID 16403) to remote domains with uncommon or suspicious TLD patterns.

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Identifies Microsoft BITS proxy connections where the destination host ends with a single-digit, indicating uncommon IP-style addressing.

Windows Process Execution via Squirrel.exe Proxy Arguments

Identifies Windows executions of Squirrel.exe/Update.exe that use processStart-style arguments to launch other processes.

Windows Process: Squirrel.exe Using Download/Update Flags to Fetch Files

Alert on Squirrel.exe/update.exe runs with --download/--update flags and HTTP in the command line.

Windows Process Creation: Mftrace.exe Child Process Execution

Alerts on child processes spawned by Mftrace.exe, which can be abused to execute arbitrary binaries on Windows.

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Flags Windows launches of VSIISExeLauncher.exe with "-p" and "-a" parameters, consistent with potential arbitrary binary execution.

Windows: Adplus.exe Execution with Memory Dump and Command Options

Alerts on Windows executions of Adplus.exe with memory-dump and inline command parameters.

Windows File Creation of .diagcab Packages

Alerts on newly created Windows .diagcab files that may indicate malicious packaging or exploitation.

Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)

Alerts when WinRAR/7-Zip/PeaZIP spawns ISO image tools, a pattern consistent with archive-delivered ISO payloads.

Detect DNS Queries to OAST Callback and Interaction Service Domains

Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.

AWS ECS Task Definition Commands Query AWS Container Credentials Endpoint

Alerts on ECS Describe/Register/Run activity when task container commands reference the container credential endpoint URI.

Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags

Alerts on renamed Plink executions using SSH port forwarding flags in Windows process creation logs.

Webserver: Suspicious Windows Path Strings in URI Query

Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.

Linux nohup Process Execution (Process Creation)

Flags Linux process launches where the image path ends with '/nohup', indicating nohup was invoked for backgrounding or persistence.