Sigma detection rules, expert-reviewed

Windows: Detect sc.exe Service Config binPath Changes to Suspicious Commands/Paths

Alerts when sc.exe updates a service binPath to point at suspicious commands or commonly abused directories.

Windows reg.exe Registry Query Reconnaissance (Process Creation)

Alerts on reg.exe process executions performing registry queries against high-value configuration and service keys.

Windows Rar.exe Files Added to Archive Activity

Alerts when Windows rar.exe is used to add files to an archive using the " a " command-line pattern.

Windows: net.exe used to start a service with the start flag

Identifies Windows processes using net.exe/net1.exe with ' start ' to start services.

Windows Msxsl.exe Execution

Flags execution of the Windows MSXSL utility (msxsl.exe), which can be abused to process attacker-controlled XSL inputs.

Windows Process: File Association Changes via assoc Command

Alerts on cmd.exe launches running the assoc command to modify Windows default file associations.

PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon

Detects PowerShell script blocks that modify Winlogon helper registry keys via Set-ItemProperty or New-Item on Windows.

Suspicious Crypto Miner User Agents in Proxy Logs

Flags proxy requests with User-Agent prefixes tied to XMRig or CCMiner crypto miners.

Linux System Owner or User Discovery via Common Utility Execution

Flags execution of Linux user/system identification utilities such as whoami and id.

Linux: Detect execution of tcpdump or tshark with interface (-i) capture option

Alerts on tcpdump or tshark executions on Linux where an interface flag is present, consistent with network sniffing.

Linux Masquerading via crond Path Using cp Launching /bin/sh

Alerts on Linux execve where cp runs through /bin/sh and the argument ends with /crond, indicating potential masquerading.

Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

Alerts on Linux execve events launching zip, gzip (-k), or tar create commands often used to compress data.

PowerShell Compress-Archive Cmdlet Execution for Data Compression

Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.

Windows Process Creation: Suspicious Command-Line Parameters for 7-Zip/RAR Executables

Detects 7z/rar executions on Windows with suspicious switches like password and delete options.

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Alerts on Linux process command lines containing ' -u#' indicative of sudo CVE-2019-14287 exploitation attempts.