Sigma detection rules, expert-reviewed

Windows: Suspicious Service Installation via Registry ImagePath Outside system32

Alerts on NalDrv/PROCEXP152 service ImagePath registry entries configured outside the expected system32 driver path.

Windows Suspicious PROCEXP152.sys Creation in Local Temp Folder

Flags creation of PROCEXP152.sys in AppData\Local\Temp, excluding events from common Sysinternals executables.

Windows Security Event 4673: SeLoadDriverPrivilege Use by Non-Whitelisted Processes

Flags Windows Event 4673 instances where SeLoadDriverPrivilege is exercised, suggesting attempts to load or unload kernel-mode drivers.

Linux Command Lines Creating Symlink to /etc/passwd

Alerts on Linux command lines attempting to create symlinks to /etc/passwd via ln -s/ln -f patterns.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows Security 5145 Network Share Access to Sensitive File Extensions

Alerts when Windows users access network-shared files with extensions commonly targeted for credential or data collection.

Windows GPO Scheduled Task Persistence via SYSVOL ScheduledTasks.xml Writes (Security 5136/5145)

Alerts on GPO changes writing ScheduledTasks.xml to SYSVOL, indicating scheduled-task persistence at scale.

Windows Security 4661 Detects Privileged AD User/Group SID Enumeration via SAM

Identifies SAM_USER/SAM_GROUP access events (4661) aimed at privileged SIDs or names containing 'admin' while ignoring computer accounts.

Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor

Flags directory ACL changes (EventID 5136) that include DCSync extended right GUIDs in ntSecurityDescriptor for DNS objects.

Windows Suspicious EXE in User Directory Launched by Microsoft Office Applications

Alert on Office spawning a .exe from C:\users\ (except when the child is Teams.exe).

Linux Suspicious Reverse Shell Command-Line Execution Patterns

Alerts on Linux command lines containing reverse-shell-style strings such as /dev/tcp redirections, netcat pipes, and socket connect patterns.

Windows process creation matching EmpireMonkey-style jscript execution from Temp Errors.bat

Alerts on Windows executions that combine /e:jscript with a \Local\Temp\Errors.bat batch path.

Windows Security Logon Event ID 4800: Workstation Lock After Inactivity

Locked Workstation

Firewall Rule Accepting Cleartext Protocol Ports

Alerts on firewall-allowed traffic to common service ports that may carry credentials over unencrypted channels.

Qualys Vulnerability Scans Indicating Default Credentials Use

Flags Qualys vulnerability scan results that indicate potential default credential usage on scanned hosts.