Sigma detection rules, expert-reviewed

Windows Shell/Scripting Tool File Write to Suspicious Directories

Alert on file writes by common Windows shells/scripting tools to C:\PerfLogs, C:\Users\Public, or C:\Windows\Temp.

macOS: Process commands with trailing space in filename to evade matching

Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

Linux wget POST-file Usage Indicating Data Exfiltration

Alerts on Linux wget commands using --post-file= to upload local files, indicating potential data exfiltration.

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Flags Exchange management events showing Get-App cmdlet failures and unhandled InvalidCastException during CVE-2021-42321 RCE attempts.

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Alerts on WinRAR/RAR process execution when launched from folders outside standard WinRAR installation paths.

Windows ADCS Template Enrollment Supplies Subject and Risky EKU (Event ID 4898/4899)

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Sitecore Pre-Auth RCE (CVE-2021-42237) exploitation attempts via Report.ashx POST

Alerts on successful HTTP POST traffic targeting Sitecore Reporting Report.ashx associated with CVE-2021-42237.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

Alerts when Office app processes initiate outbound TCP/HTTP(S)/mail connections to non-private IPs, excluding common private and known provider ranges.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.