Sigma detection rules, expert-reviewed

Windows Process Creation: cscript/wscript Register-App.vbs COM+ Registration

Alert on cscript/wscript running “.vbs -register” to register COM+ components, potentially leveraging register_app.vbs.

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Flags cmdl32.exe executions using /vpn and /lan that may indicate arbitrary file retrieval behavior.

Linux: Kernel Module Loading via insmod (kmod)

Flags Linux auditd syscalls where insmod is executed via /usr/bin/kmod to load a kernel module.

Windows Process Creation: PowerShell ExecutionPolicy Set to Bypass/Unrestricted

Alerts on PowerShell started with -ExecutionPolicy set to Bypass/Unrestricted, indicating a potentially insecure script execution posture.

Windows Process Creation: Command-Line Indicators of Crypto Mining

Alerts on Windows processes with command-line arguments matching common crypto miner pool and configuration indicators.

Windows Process Creation: Suspicious Command-Line Path Traversal Evasion Strings

Flags Windows command-line strings that look like “..\” path traversal evasion attempts, excluding known Google Drive and Citrix launcher patterns.

Windows Network Connections to Known Crypto Mining Pools

Flags Windows hosts making outbound connections to known cryptocurrency mining pool domains.

Linux Process Creation Crypto Miner Command-Line Indicators

Alerts on Linux process executions with command-line strings typical of crypto mining pools, stratum endpoints, and miner options.

Linux Process Network Connections to Crypto Mining Pool Hosts

Flags Linux outbound connections to known Monero mining pool domains.

Windows Browser Process Creating VHD/VHDX Files via Download

Alerts when a Windows browser process creates files containing .vhd, indicating potential VHD/VHDX staging.

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

DNS Queries for Monero Mining Pool Domains

Alerts on DNS queries to known Monero mining pool domains that may indicate cryptomining activity.

Windows: CertOC.exe certificate utility loading a DLL via -LoadDLL

Flags CertOC.exe launching with -LoadDLL to load a specified DLL on Windows.

Windows Process Execution via WorkFolders.exe Launching control.exe

Alerts when WorkFolders.exe spawns a non-standard control.exe instance on Windows.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.