Sigma detection rules, expert-reviewed

Antivirus detections of PrinterNightmare PoC file creation path on Windows

Alerts on antivirus events where filenames include the Windows spooler driver x64 directory path, excluding Symantec submission messages.

Windows SMB Client Security: Rejected Guest Logon with Blank UserName

Flags rejected SMB guest/anonymous-style logons on Windows when the SMB username is blank.

Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation

Looks for Print Spooler plug-in/module load errors in Windows logs that may indicate CVE-2021-1675 exploitation attempts.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption

Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.

Pulse Connect Secure web exploitation attempts for CVE-2021-22893

Detects web requests to Pulse Connect Secure with URI query patterns consistent with CVE-2021-22893 exploitation attempts.

Windows ImageLoad of DLL from spoolsv.exe spool drivers subfolders

Flags spoolsv.exe DLL loads originating from Print Spooler x64\3/x64\4 driver folders on Windows.

Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation

Flags Windows file events referencing a specific spooler driver path pattern associated with CVE-2021-1675 PoC activity.

Windows reg.exe Run Key Modification for Persistence via Process Creation

Alerts on reg.exe commands that add values to Windows Run registry keys, a common persistence technique.

AWS CloudTrail: Security Hub findings evasion via finding updates or deletions

Identifies Security Hub finding and insight modifications (update or delete) that may impair detection results.

Windows Process Creation: WMIC.exe ActiveScriptEventConsumer Creation Attempt

Alerts on WMIC.exe command lines attempting to create an ActiveScriptEventConsumer for event-driven script execution.

Zeek x509: Default Cobalt Strike certificate serial observed in HTTPS traffic

Flags Zeek x509 certificates used in HTTPS when the certificate serial matches a known default Cobalt Strike value.

Windows PortProxy Registry Key Modified for Port Forwarding

Alerts when PortProxy port-forwarding registry entries under the Windows TCP v4tov4 path are added or modified.

Windows: Detect execution of renamed megasync.exe (original MegaSync) via process creation

Flags process launches where megasync.exe appears under a renamed or nonstandard execution context based on process creation fields.

Windows LDAP Client Event ID 30 Active Directory enumeration via LDAP search filters

Flags LDAP search queries indicative of Active Directory reconnaissance/enumeration using Event ID 30 filter patterns.