Sigma detection rules, expert-reviewed

Linux JexBoss Suspicious Bash Command Launch with /dev/tcp

Flags Linux executions containing bash -c /bin/bash paired with /dev/tcp/ indicative of a reverse-shell command sequence.

sshd Buffer Underflow Error Message Matching CVE-2018-15473 Exploit Attempt (Linux)

Flags Linux sshd pre-auth buffer parsing error messages that align with CVE-2018-15473 exploit attempts.

Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.

Windows WMI Persistence via Security Event 4662 on WMI subscription namespace

Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.

Linux Suspicious Shell Command Lines for Exploit/Payload Delivery

Detects Linux command-line strings matching wget/piping, payload staging, permission changes, and socat/HTTP server execution patterns.

Windows svchost.exe Spawned by Uncommon Parent Process

Alerts when svchost.exe starts with an unusual parent process name on Windows.

Python SQL Exception Errors Indicating Database Interaction Failures

Identifies Python application logs referencing common SQL exception classes from DB-API (PEP 249).

Java Spring Framework Exception Alerts for Access Denied and CSRF Failures

Alerts on Spring Security exception keywords related to access denial, CSRF, cookies, and request rejection in application logs.

Ruby on Rails Exception Keyword Alerts for Invalid Requests

Flags Rails ActionController exceptions in application logs that may signal probing or exploitation via invalid requests.

Django Application Error Exceptions Matching SuspiciousOperation and Security Exceptions

Identifies Django logs containing suspicious security-related exception names that may indicate exploitation attempts.

Windows Security: Account Encryption/Preauth/Delegation Flags Weakened in User Account Changes

Flags Windows Event ID 4738 user account changes that enable weaker encryption or related pre-auth behavior.

Windows Security: SeEnableDelegationPrivilege Enabled via AD User Right (Event 4704)

Alerts when Event ID 4704 assigns SeEnableDelegationPrivilege, enabling control over other AD user objects.

Windows rundll32 execution matching ZxShell function and remote disk strings

Alerts on rundll32.exe command lines containing zxFunction and RemoteDiskXXXXX indicative of ZxShell execution.

Suspicious Malformed User-Agent Strings in Proxy Logs

Flags proxy requests whose User-Agent headers are malformed or match suspicious automation/tooling patterns, excluding known Adobe/Acrobat traffic.

Suspicious Malware User-Agent Strings in Proxy Logs

Alerts on proxy traffic with user-agent values and substrings commonly seen in malware communications.