Sigma detection rules, expert-reviewed

Windows DNS Queries to Known DPRK C2 Domains

Flags Windows DNS queries for specific DPRK-attributed C2 domain names.

ScreenConnect Service temp XML user database file modification (Windows Event 4663)

Alerts when ScreenConnect.Service.exe performs write access to temporary ScreenConnect XML user database files on Windows.

Webserver Path Scan for ScreenConnect SetupWizard Authentication Bypass (CVE-2024-1709)

Alerts on web requests to '/SetupWizard.aspx/' that match exploitation patterns for ScreenConnect authentication bypass CVE-2024-1709.

Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns

Flags proxy HTTP requests whose URI, method, User-Agent, host, and cookie fragments match known Cobalt Strike malleable profile patterns.

Windows Module Usage Enumeration via tasklist.exe -m rdpcorets.dll

Flags tasklist.exe module enumeration (-m) targeting rdpcorets.dll to identify the owning process.

Windows sc.exe Service Query for termservice Enumeration

Alerts on sc.exe service querying that references termservice on Windows.

Windows: AnyDesk Execution Using Revoked Certificate Versions

Detects AnyDesk.exe execution on Windows when the file version matches known revoked-certificate releases (excluding uninstall/remove).

FortiOS sslvpnd CVE-2022-42475 Exploitation Indicator Keyword Matching

Flags FortiOS sslvpnd activity containing known CVE-2022-42475 artifact paths from file-related events.

Windows iexpress.exe Creates Self-Extracting Binaries Using SED Files From Suspicious Paths

Flags suspicious use of Windows iexpress.exe to create self-extracting packages via SED directives from uncommon/temp paths.

Windows: Alerts on Creation of .sed Self-Extraction Directive File

Flags creation of newly created .sed directive files on Windows, which can be used for self-extracting package abuse.

Windows Self Extraction Directive (.sed) File Created in Suspicious Paths

Alerts on .sed directive file creation under ProgramData/Temp/Tasks paths on Windows, consistent with iExpress-based packaging abuse.

Windows Process Creation: IExpress.exe Creating Self-Extracting Packages

Identifies IExpress.exe usage to generate self-extracting packages, including makecab.exe involvement and IExpress command-line patterns.

Windows WMI Disk and Volume Discovery via WMIC.exe

Flags WMIC.exe process executions that query Win32 logical disk and volume listing details.

Windows SharpMove (.NET) Execution via SharpMove.exe and Action Command-Line Flags

Alerts on SharpMove.exe process execution with command-line actions for DCOM, WMI VBS, and task scheduler.

Windows EDRSilencer Execution via Filtering Platform FilterName Change

Detects Filtering Platform custom outbound filter additions associated with potential EDRSilencer execution on Windows.