Sigma detection rules, expert-reviewed

Windows: Renamed Sysinternals DebugView Process Execution

Flags Windows executions labeled as Sysinternals DebugView when the image is not the original Dbgview.exe.

Windows: New Executables Named After System Processes in Non-System Paths

Alerts on creation of executables named like common system processes in unexpected Windows directories.

ComRAT Proxy HTTP Requesting index.php with h Parameter

Flags proxy HTTP requests with URIs containing /index/index.php?h=, consistent with web-based C2 behavior.

Confluence CVE-2019-3398 Web Exploitation via Path Traversal Upload POST Request

Alert on Confluence POST /upload.action requests with query-based path traversal filename patterns consistent with CVE-2019-3398.

Windows process command lines matching May 2020 Turla ComRAT command patterns

Triggers on Windows command lines matching a set of Turla-related indicators documented by ESET (May 2020).

Windows netsh.exe Whitelists Allowed Program from Suspicious Path in Firewall

Flags netsh.exe firewall allow rules that whitelist a program located in suspicious Windows filesystem paths.

Windows RDP Port 3389 Allowed via netsh.exe Firewall Rule Creation

Flags netsh.exe commands that add firewall rules allowing TCP port 3389 (RDP).

Windows Registry: Office VBAWarning Disabled (VBAWarnings set to 1)

Alerts on Security\VBAWarnings being set to DWORD 0x00000001, enabling all Office VBA macros.

Windows Registry Set AccessVBOM DWORD=1 Disables Access Security for Access VBA

Alerts on Windows registry changes setting Security\AccessVBOM to DWORD 1, disabling VBA trust access to bypass Office warnings.

Windows: CrackMapExec PowerShell obfuscation via join/split static patterns

Flags Windows PowerShell executions with command-line obfuscation strings associated with CrackMapExec behavior.

Windows NTLM Logon to TERMSRV on Non-Domain Hosts

Alerts on Windows NTLM events tied to TERMSRV targets that may be non-domain hosts, suggesting potential RDP access.

Windows: Process executions matching Greenbug espionage tool indicators

Alerts on Windows process creation with command-line patterns matching PowerShell execution-policy bypass and reverse-shell related tooling.

Linux auditd: New user account creation via useradd (ADD_USER/SYSCALL)

Flags Linux auditd evidence of new local user accounts created using useradd.

Linux auditd: Alert on suspicious C2-related command executions

Alerts on auditd executions of common C2-adjacent tools when labeled with the "susp_activity" key.

Windows Network Connections Initiated by Notepad.exe

Alerts when notepad.exe initiates an outbound network connection, excluding typical printing traffic on port 9100.