Sigma detection rules, expert-reviewed

Windows Process Execution Proxy Using SyncInvoke in CL_Invocation.ps1

Alerts on Windows command lines containing "SyncInvoke" consistent with CL_Invocation.ps1 execution proxy behavior.

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

macOS Network Sniffing Tool Execution via tcpdump or tshark

Identifies macOS execution of tcpdump or tshark, indicating potential network traffic sniffing activity.

macOS Startup Item Plist Created in StartupItems Folders

Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.

Windows Registry-Based DLL Hijack via WAB.EXE Using WAB Registry DLLPath

Flags WAB.EXE DLLPath registry writes where the configured DLL path differs from the default.

Windows Process Creation: accesschk.exe Permission Audit Execution

Flags AccessChk (accesschk.exe) permission/audit executions using common query flags in Windows process creation logs.

Windows te.exe Execution of Test Components (TAEF) via Process Creation

Alerts on process activity involving te.exe, which may indicate TAEF-based execution of malicious test components.

Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell

Flags installer-initiated spawning of cmd.exe or PowerShell from Windows\Installer temporary msi-related processes.

Detect Elevated Windows Installer (msiexec) Running as SYSTEM

Flags msiexec.exe MSI activity from Windows Installer running with SYSTEM integrity, excluding known benign parent contexts.

Windows PowerShell via sqltoolsps.exe (sqltoolsps.exe child process exclusion)

Flags suspicious sqltoolsps.exe executions that may launch PowerShell, excluding cases where smss.exe spawned the utility.

Windows manage-bde.wsf via wscript/cscript Proxy Execution

Flags Windows process executions where wscript/cscript runs manage-bde.wsf, indicating potential proxy execution via LOLBIN.

Windows Process Command Line: Detect VAR++ LAUNCHER Obfuscated PowerShell

Flags Windows command lines showing VAR++ launcher-style obfuscated PowerShell execution through Invoke-Expression patterns.

Windows Process Creation: Obfuscated Cmd Uses clip.exe to Execute PowerShell

Alerts when cmd.exe uses obfuscated Clip.exe/clipboard calls to launch PowerShell.

Detect VAR++ LAUNCHER-Style Obfuscated PowerShell Command Block

Detects VAR++ LAUNCHER-like PowerShell obfuscation patterns in ScriptBlockText.

PowerShell Script Block Obfuscation via cmd/clipboard and clip.exe execution

Identifies obfuscated PowerShell script blocks launching clip.exe and chaining clipboard-related execution.