Sigma detection rules, expert-reviewed

Windows Process Execution Matches Griffon Malicious Command-Line Pattern

Alerts on Windows process command lines containing a temp staging path plus jscript execution indicators and a .txt target.

Windows DNS Client: Cobalt Strike DNS Beaconing Patterns via Suspicious Query Names

Alerts when Windows DNS client logs show Event ID 3008 DNS queries matching Cobalt Strike beacon patterns.

Webserver: OWASSRF exploitation attempt via OWA to PowerShell backend

Flags webserver POSTs returning 200 that request both /owa/mastermailbox and /powershell, consistent with OWASSRF exploitation attempts.

Detects OWASSRF Proxy Exploitation Attempt via OWA to PowerShell Backend

Identifies proxy POSTs that return 200 and request both /owa/mastermailbox and /powershell, indicating potential OWASSRF exploitation.

Windows Process Creation: SysmonEOP.exe HackTool Execution (CVE-2022-41120 PoC)

Alert on Windows process execution of \SysmonEOP.exe with specific IMPhashes associated with the SysmonEOP PoC.

Inveigh Execution via Process Creation (Windows)

Detects execution of Inveigh.exe on Windows with spoofing/sniffing command-line flags consistent with MITM behavior.

Windows Inveigh HackTool Execution Artefacts via Inveigh File Indicators

Alert on Windows file creation or presence of Inveigh log, script, and binary artefacts identified by distinctive filename suffixes.

Windows Process Execution: SafetyKatz HackTool (SafetyKatz.exe)

Alerts when a process running SafetyKatz.exe is created, using image path and embedded file metadata.

Windows Security: Suspicious SAMTHEADMIN-* Computer/Account Names Ending with $

Alerts on Windows Security events with computer account names starting SAMTHEADMIN- and ending with $.

Windows process command line matching Sliver C2 implant NoExit PowerShell UTF8 pattern

Alerts on Windows process command lines matching a Sliver-style PowerShell -NoExit encoding pattern.

Windows: SharpUp (SharpUp.exe) Local Privilege Escalation Tool Execution

Flags SharpUp.exe execution on Windows when command line indicators reference common privilege-escalation targets.

Windows named pipe creation matching DiagTrackEoP POC pipe name fragment

Flags Windows creation of a named pipe matching the DiagTrackEoP POC’s default pipe name.

Windows Security: DiagTrackEoP POC Default UserName Login Attempt (LogonType 9)

Alerts on Windows 4624 LogonType 9 events targeting a known DiagTrackEoP default username.

Windows: Detect Named Pipe Creation with Koh Default Names

Alerts on Windows named pipe creation with Koh default identifiers in the pipe name.

Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)

Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.