Sigma detection rules, expert-reviewed

Windows Webserver Parent Process Launching Credential Dumping and Exfiltration Commands

Flags web server processes spawning child commands consistent with credential dumping, exfiltration, and privilege changes.

Windows PktMon.exe Process Execution (pktmon.exe / PktMon.exe)

Alerts on Windows executions of PktMon.exe based on process creation image name and OriginalFileName.

Windows PowerShell: Suspicious Process Discovery Using Get-Process

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

Windows PowerShell Directory Enumeration via Get-ChildItem and Output Redirection

Flags PowerShell directory enumeration patterns using Get-ChildItem, error suppression, and appended output to a file.

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

PowerShell Get-ADUser Enumeration Using UserAccountControl DONT_REQ_PREAUTH Flag

Flags Get-ADUser PowerShell scripts enumerating accounts by UserAccountControl DONT_REQ_PREAUTH (4194304).

Windows PowerShell: Suspicious Get-ADDBAccount access to ntds.dit via BootKey and DatabasePath

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

Windows Remote Thread Creation Targeting Uncommon System Image Processes

Alert on Windows remote thread creation events targeting a predefined list of uncommon processes by image path.

Windows schtasks.exe Create Executes File from AppData\Local

Alerts on schtasks.exe creating tasks that run payloads from C:\Users\<user>\AppData\Local.

Linux Process Creation: Shell Command Piped Into Another Shell

Flags Linux processes that start with sh/bash -c and pipe execution into a subsequent shell.

Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image

Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.

Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping

Alerts on Windows command lines using for/foreach loops that also run nslookup or ping, consistent with host scanning.

Windows HackTool Process Patterns for CrackMapExec LSASS Dumping

Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.