Sigma detection rules, expert-reviewed

Windows: WinRM Service Process Spawning Command-Line and Scripting Utilities

Flags suspicious child shells and admin utilities spawned by the WinRM host process (wsmprovhost.exe) on Windows.

PowerShell Script Block Logging: PowerView cmdlet names match

Alerts when PowerShell ScriptBlockText includes PowerView/PowerSploit reconnaissance cmdlet names tied to domain and access discovery.

AWS CloudTrail: EC2 Snapshot Attribute Permission Modified for Cross-Account Access

Alerts on CloudTrail ModifySnapshotAttribute events indicating EC2 snapshot permissions were changed for other-account access.

Windows Process Command Lines Indicating ngrok.exe Tunnel Setup

Detects Windows executions of ngrok.exe with TCP/HTTP tunneling and authtoken/start-all YAML configuration patterns.

Windows process creation patterns associated with DarkSide ransomware helpers

Detects Windows process creation consistent with DarkSide ransomware helper execution using encoded command-line content.

Webserver Indicators of Successful Exchange CVE-2021-28480 Exploitation via OWA Calendar POST

Flags POST requests to OWA calendar endpoint patterns linked to CVE-2021-28480, excluding HTTP 503 responses.

Windows: Detect Rclone command execution with exfiltration-oriented flags

Identifies likely rclone.exe exfiltration activity on Windows by matching command-line flags and rclone executable characteristics.

Windows Service Creation Indicators for Moriya Rootkit (ZzNetSvc via Service Control Manager)

Alerts on creation of the "ZzNetSvc" service by Service Control Manager (Event ID 7045) on Windows.

Windows Driver File MoriyaStreamWatchmen.sys Created in System32\drivers

Alerts when the Windows system32 drivers directory receives the MoriyaStreamWatchmen.sys file.

Windows whoami.exe Privilege Enumeration Using /priv Flag

Alerts on whoami.exe runs with /priv or -priv to enumerate current user privileges.

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

Windows Pingback backdoor via ICMP C2 using updata.exe command-line parameters

Flags Windows process creation where updata.exe spawns msdtc config start auto commands consistent with Pingback backdoor.

Windows DLL Loading of C:\Windows\oci.dll by msdtc.exe

Flags msdtc.exe loading C:\Windows\oci.dll, consistent with Pingback backdoor DLL loading behavior.

Windows File Indicator for Pingback Backdoor updata.exe Writing oci.dll

Alerts on updata.exe creating or modifying C:\Windows\oci.dll as a Pingback backdoor file indicator.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.