Sigma detection rules, expert-reviewed

Windows Office Startup Folder File Creation with Uncommon Extension

Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.

Windows rundll32 Locks Workstation via user32.dll LockWorkStation

Flags cmd-launched rundll32.exe calling user32.dll LockWorkStation to lock the user workstation.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

Java Payload Indicators in Web Server Logs

Alerts when web access logs contain Java payload-like strings indicating possible injection or runtime execution attempts.

Windows Process Creation: Renamed msdt.exe Execution

Flags Windows process creation where OriginalFileName is msdt.exe and the executable appears to be a renamed copy.

Python Process Spawning a Pretty TTY via pty.spawn on Windows

Flags Windows python executions whose command line imports pty and calls pty.spawn to create a pseudo-terminal.

Linux Java Process Launching Suspicious Shell and Scripting Children

Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.

Linux Python Spawning Pseudo-Terminal via pty Module

Flags Linux executions where Python imports the pty module and calls spawn to create a pseudo-TTY session.

Linux chmod Process Commandlines Targeting Sensitive Directory Paths

Flags Linux chmod commands that modify permissions for paths under /tmp/, /.Library/, /etc/, or /opt/, excluding several known benign package-maintenance patterns.

Linux process creation: Confluence Java spawning script or download utilities

Alerts when Confluence’s Java process on Linux spawns shell or scripting/utilities, consistent with potential CVE-driven command execution.

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.

Windows Process Creation: Remote.exe Execution

Alerts on execution of remote.exe on Windows, which can be abused via a WinDbg/SDK binary for stealthy remote execution.

Windows Process Execution of F# Interpreters (Fsi.exe, FsiAnyCpu.exe)

Flags execution of F# interpreter binaries fsi.exe and fsianycpu.exe on Windows.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.

Windows Office Startup Folder File Drop for Persistence via Office Documents

Alerts when Office documents/templates are created in Word/Excel startup folders on Windows, suggesting persistence attempts.