Sigma detection rules, expert-reviewed

Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)

Flags Windows image loads of Time Travel Debugging Utility DLLs (tdrecord/tdwriter/tdloader), often abused for stealthy credential dumping.

Windows file events: Winrm.vbs payload XSL execution artifacts WsmPty.xsl/WsmTxt.xsl outside system folders

Alert on WsmPty.xsl/WsmTxt.xsl files written outside System32 and SysWOW64, consistent with WinRM VBScript misuse.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Script Execution via Windows Service Creation (Service Control Manager)

Flags service creation/start events where the service ImagePath references PowerShell (powershell/pwsh).

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.

macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults

Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.

macOS Cron Task Abuse via crontab Executed from /tmp

Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.

macOS Local User Account Creation via dscl or sysadminctl

Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.

Linux System Network Discovery via Firewall/Network Tools

Alerts on Linux process activity running common network/firewall tools and DNS discovery indicators.

Linux Cron Abuse via crontab Executed with /tmp/ File Paths

Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.

Linux at/atd Process Execution via /at or /atd

Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.

Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

PowerShell Remote Thread Creation (Windows CreateRemoteThread)

Alerts when PowerShell creates a remote thread in another process, excluding CompatTelRunner.exe activity.

Linux process discovery via common process listing and monitoring tools

Flags Linux execution of common tools used to enumerate running processes.