Sigma detection rules, expert-reviewed

Windows PowerShell Base64 Command Line Executing IEX

Identifies Windows PowerShell processes with Base64-encoded command-line content that contains an IEX execution pattern.

Windows: WmiPrvSE.exe Spawning a Child Process

Identifies child processes created by WmiPrvSE.exe on Windows, highlighting potential WMI-based execution attempts.

Windows Security: Non-System SeTakeOwnershipPrivilege granted on SCM database object

Flags non-system users requesting SeTakeOwnershipPrivilege on the SCM database object servicesactive in Windows Security 4674.

Cisco AAA commands: shutdown or config-register changes to boot into alternate modes

Flags Cisco AAA events referencing shutdown or config-register 0x2100/0x2142 changes that may disrupt boot or availability.

Windows Security: SysKey-related LSA Registry Key Access (4656/4663)

Alerts on access to LSA registry keys used to compute SysKey based on Windows Security handle and registry object events.

Windows Security Event 4656: Non-system handle failure to SCM database object

Alerts on failed SCM database handle requests for ServicesActive from non-system logons using Windows Security Event ID 4656.

Windows Security Event 4656: SAM Registry Hive Key Handle Requested

Flags Windows handle requests to registry keys ending with \SAM using Security EventID 4656.

Cisco AAA keyword hits for data staging and file transfer commands (TFTP/RCP/PUT/COPY/ARCHIVE)

Flags Cisco AAA activity containing TFTP/RCP and copy/archive commands commonly used to stage data on devices.

Cisco AAA Configuration Modification Command Patterns

Flags Cisco AAA command activity that includes keywords for configuration changes like HTTP/HTTPS, KRON, ACLs, and NTP.

Cisco AAA local account and remote authentication changes

Flags Cisco AAA log events showing local username/account changes and remote authentication configuration updates.

Cisco AAA Commands Indicating File Deletion on Local Flash Storage

Flags Cisco AAA log entries referencing flash file erase, delete, or format operations that may indicate stealthy cleanup.

Cisco AAA discovery via show/dir commands

Alerts on Cisco AAA log entries with discovery-oriented 'dir' and 'show' command keywords.

Cisco IOS AAA Crypto PKI Export/Import Commands

Alerts on Cisco IOS AAA logs showing crypto PKI export of private keys or PKI import of certificates/trustpoints.

Cisco Network OS Log and Archive Clearing via “clear logging” Commands

Flags Cisco network OS attempts to clear logs or archives via AAA command text.

Cisco AAA configuration changes enabling SPAN/RSPAN monitoring capture

Alerts on Cisco AAA logs referencing SPAN/RSPAN or monitor capture point configuration changes.