Sigma detection rules, expert-reviewed

Linux Service Reload/Start via systemctl or service Command Execution

Identifies Linux process executions invoking service control commands with start or reload keywords.

Linux auditd: chmod/chown process execution indicating file or folder permission changes

Flags Linux EXECVE events running chmod or chown, which commonly correspond to file/folder permission changes.

Linux auditd: Detect chattr -i removing immutable file attribute

Flags Linux processes using chattr to remove the immutable (-i) file attribute via auditd execve telemetry.

Windows Registry: Enable WDigest UseLogonCredential (Use clear-text logon credential setting)

Flags registry writes that enable WDigest UseLogonCredential, turning on potential clear-text credential storage.

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Alerts when wsmprovhost.exe is seen as a process or parent process, indicating remote PowerShell via WinRM.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Windows Named Pipe Created for PowerShell PSHost Instance

Alerts on named pipe creation with a \PSHost prefix, indicating PowerShell host-related activity.

Windows Named Pipe Creation: Alternate PowerShell Host via \PSHost

Alerts on creation of \PSHost named pipes to identify alternate PowerShell host usage via Windows pipe events.

Windows: WinRM inbound network connections to ports 5985/5986 for PowerShell remoting

Alerts on WinRM inbound connections (ports 5985/5986) consistent with remote PowerShell remoting activity.

Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)

Flags AD DS Security Event 4662 activity indicating WRITE_DAC permission changes on domain objects.

Windows Suspicious Debugger Registration via Image File Execution Options

Alerts on Windows attempts to set Image File Execution Options debuggers for logon screen binaries via command-line arguments.

Windows Process Creation: Empire PowerShell UAC Bypass CommandLine Pattern

Flags Windows process creation events running Empire-style PowerShell UAC bypass command fragments.

Windows Registry: Modification of WDigest IsCredGuardEnabled to Disable Credential Guard

Alerts on Windows registry changes to WDigest\IsCredGuardEnabled that may disable Credential Guard.

PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Flags PowerShell command lines containing FromBase64String along with base64-encoded UTF-16 marker patterns.

Windows: Alert on csc.exe Executing from User-Writable or Suspicious Paths

Alerts when csc.exe is launched from user/temp-like paths, indicating potential on-the-fly .NET compilation.