Sigma detection rules, expert-reviewed

Windows: Alert on Outbound Connections Initiated by dialer.exe (Microsoft Phone Dialer)

Alerts on outbound connections started by Windows dialer.exe, excluding common local and reserved IP ranges.

Windows Process Creation: SoftPerfect netscan.exe Network Scanner Execution

Alerts on execution of SoftPerfect Network Scanner (netscan.exe), a potential network reconnaissance tool.

Windows RegAsm.exe Initiates Network Connection to Public IP

Alerts on RegAsm.exe initiating outbound connections to public (non-local/private) IP addresses.

Windows: .pth Python Path Configuration File Created in site-packages or venv

Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.

macOS Python Site-Packages .pth File Creation

Alerts on new .pth files created under macOS Python site-packages, a mechanism that can execute code at Python startup.

Linux: Detect Python .pth Path Configuration File Creation in site-packages

Alerts on creation of Python .pth files in /lib/python3.X/site-packages on Linux, which can trigger code at Python startup.

Palo Alto GlobalProtect PAN-OS Device Telemetry File Creation with Command Injection Filename Markers

Detects suspicious GlobalProtect device telemetry file creations with filenames containing CVE-2024-3400 command-injection indicators.

Windows Registry Set: Custom Protocol Handler DLL for CLSID {026CC6D7-34B2-33D5-B551-CA31EB6CE345}

Alerts when a Windows registry entry for a specific custom protocol handler CLSID is set to a DLL.

Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity

Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.

Windows JavaScript file creation in DriverStore FileRepository

Alerts on creation of .js files under DriverStore\FileRepository based on the target path in Windows file events.

Windows File Creation: ProgramData Persistence Artifacts Matching

Alerts on Windows file creations in C:\ProgramData matching specific driver inf, .dll, and batch/script filename patterns.

Suspicious Palo Alto GlobalProtect Session Unmarshal Path Traversal and Command Injection Attempts

Detects GlobalProtect logs with directory traversal/command injection-style indicators tied to CVE-2024-3400 behavior.

Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code

Alert on Duo successful MFA logins that are attributed to bypass-user codes.

Linux Pnscan Binary Data Transfer via Command-Line

Flags Linux executions with Pnscan-like arguments indicating binary send/receive data transfer.

Windows DLL side-loading: KeyScramblerIE.DLL loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.