Sigma detection rules, expert-reviewed

Windows Event Viewer (eventvwr.exe) Spawns Suspicious Child Processes

Alerts when eventvwr.exe spawns unusual child processes in Windows process creation logs.

Windows Network Connections to Uncommon Ports (8080, 8888)

Flags Windows-initiated connections to ports 8080/8888 excluding private/local IPs and Program Files binaries.

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Flags Windows processes initiating outbound connections to malware callback ports, excluding local/private IP ranges.

Windows network connection from process running in suspicious or uncommon file paths

Alerts on Windows network connections initiated by processes executing from suspicious or uncommon directories.

Windows UAC Bypass Indicator via sdclt Registry Key Manipulation

Alerts on registry set activity consistent with sdclt-related UAC bypass key manipulation.

Windows Security: Local Administrators Group Membership Change (Event 4732)

Flags Windows Event 4732 where a user is added to the local Administrators group.

Linux Log Shellshock Expression Pattern Matching

Identifies Shellshock-style function-body expressions in Linux log data via keyword string matches.

Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)

Alerts when proxy traffic shows a User-Agent containing "WindowsPowerShell/", consistent with PowerShell web access.

Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains

Finds proxy traffic requesting executable or script/doc payloads from hosts with suspicious TLDs not in the whitelist.

Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)

Flags outbound network connections initiated by PowerShell on Windows, excluding common local and private IP ranges.

Windows PowerShell ScriptBlock with Encoded, Hidden, or Noninteractive Execution Parameters

Alerts on PowerShell ScriptBlockText containing encoded command, hidden window, or noninteractive execution parameters.

Suspicious PowerShell Module Execution Using Encoded, Hidden, or Noninteractive Context (Windows)

Alerts on PowerShell module executions using encoded commands, hidden windows, or noninteractive flags to evade visibility and interaction.

Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments

Flags bitsadmin.exe being started with parameters consistent with transferring/downloading files from an http URL.

Windows Security: Detects SAM User/Group Access During Domain Recon (Event ID 4661)

Alerts on Event ID 4661 accesses to SAM user/group objects for domain Administrator and Domain Admins.

Windows Service Install: NtsSrv (StoneDrill) via Service Control Manager Event 7045

Flags Windows service installs of NtsSrv by Service Control Manager with an ImagePath ending in " LocalService".