Sigma detection rules, expert-reviewed

Windows rundll32.exe Command-Line RunDLL or Control_RunDLL Execution

Alerts on rundll32.exe process launches whose command lines end with RunDLL/Control_RunDLL, indicative of DLL function loading.

Windows Process Creation Alerts for Suspicious Lazarus-Linked Command-Line Execution

Alerts on Windows process executions with command-line substrings consistent with behaviors described in Lazarus activity reports.

Detect SolarWinds SUPERNOVA Webshell URL Access on Webservers (logoimagehandler.ashx)

Identifies webserver traffic consistent with SUPERNOVA webshell access targeting logoimagehandler.ashx with a clazz query parameter.

Windows: Suspicious Child Processes Spawned by sqlservr.exe

Alerts when SQL Server (sqlservr.exe) spawns suspicious command/system tools on Windows.

Fortinet SSL VPN Exploitation Attempt via Path Traversal in Web Requests (CVE-2018-13379)

Alerts on HTTP requests matching a Fortinet SSL VPN traversal-style query indicative of CVE-2018-13379 exploitation.

Windows Process Tree: rundll32.exe launching wermgr.exe via DllRegisterServer

Flags rundll32.exe spawning wermgr.exe where rundll32 command line includes DllRegisterServer.

Web server request pattern consistent with Oracle WebLogic CVE-2020-14882 exploitation

Detects WebLogic console exploitation attempts by matching encoded traversal patterns in HTTP URI query strings.

Windows Registry Run Key Modification via winekey or team9 backdoor

Detects registry Run key changes to "Backup Mgr" that may indicate persistence via winekey/team9.

Windows PsExec Execution Triggered by psexec.exe Process Creation

Flags process creation of PsExec (psexec.exe / psexec.c), a tool often used for remote execution and potential lateral movement.

Windows Credential Access via Reg Add in LSA Registry Paths

Alerts when reg add commands target LSA registry settings and scecli entries commonly abused for credential access.

Windows Process Creation: bitsadmin.exe BITS jobs with SetNotifyCmdLine or remote file additions

Alerts on bitsadmin.exe command lines using /SetNotifyCmdLine or /Addfile to execute after download or stage remote files.

Windows Image Load of PCRE.NET Package Temp Module Path

Alerts on Windows processes loading a temp module path tied to a PCRE.NET package component.

Windows Processes Creating PCRE.NET Temp Package Files

Identifies Windows processes writing temp files with a PCRE.NET package-specific path under AppData\Local\Temp.

Windows: Abused Debug Privilege via Command-Line Route/Add Spawned by System Parents

Flags PowerShell/cmd spawned by system processes with command lines containing both 'route' and 'ADD'.

Windows Registry Persistence via Office Test Startup Key

Flags registry changes to a Windows Office test startup key that may enable auto-execution of an arbitrary DLL.