Sigma detection rules, expert-reviewed

Windows Network Connections to *.devtunnels.ms

Alerts on initiated Windows network connections to .devtunnels.ms hostnames, which may indicate remote access use.

Windows Process Creation: Detect Event Log Query via wmic.exe, wevtutil.exe, or PowerShell

Detects command-line attempts to query Windows Event Logs using wevtutil, wmic, or Get-WinEvent/Get-EventLog.

Webserver POST requests to Confluence setup/restore endpoints matching CVE-2023-22518 exploit traffic

Detects POST traffic to Confluence CVE-2023-22518 vulnerable endpoints based on URI patterns and HTTP status codes.

HTTP POST exploitation attempt against Confluence CVE-2023-22518 vulnerable setup endpoints (Proxy logs)

Flags proxy POST requests to known Confluence setup/admin endpoints returning 200/302/405, aligned with CVE-2023-22518 exploitation attempts.

Windows: Detects Suspicious cmd.exe or PowerShell spawned from Confluence (tomcat) Processes

Alerts when Confluence/embedded Tomcat spawns cmd.exe or PowerShell on Windows, indicating possible command execution after exploitation.

CVE-2023-22518 Confluence Exploitation Attempt via Suspicious Bash/Curl/Wget Child Processes on Linux

Alerts when Confluence Java spawns shell/download tools on Linux consistent with CVE-2023-22518 exploitation behavior.

Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp

Alerts when excel.exe spawns foxprow.exe, schdplus.exe, or winproj.exe, consistent with suspicious Excel DCOM automation activity.

Windows: Command-Line Use of ms-appinstaller Protocol Handler for File Downloads

Alerts on Windows command lines invoking ms-appinstaller with an http source, indicating potential remote file download behavior.

Windows msxsl.exe Execution with HTTP Keyword in Command Line

Flags execution of msxsl.exe when the command line includes an HTTP URL indicator.

Windows: File Download via msedge_proxy.exe Using HTTP/HTTPS URLs

Flags msedge_proxy.exe executions that include HTTP/HTTPS URLs, consistent with arbitrary file downloads.

Windows Process Creation: Detect IMEWDBLD.EXE Downloading Files via HTTP/HTTPS

Alerts when IMEWDBLD.exe runs with an HTTP/HTTPS URL, indicating arbitrary file downloads.

Windows: Detect SysAid user.exe Loader Execution by Filename and SHA256 Hash

Flags execution of a specific SysAid-hosted Windows binary when the process image path and SHA256 match.

Windows Process Execution for PowerShell Cobalt Strike Download via Hidden IEX

Flags PowerShell command lines that use IEX and hidden downloadstring to fetch a Cobalt Strike payload.

Windows PowerShell script launcher matching SysAidServer Tomcat paths

Flags PowerShell script block text tied to SysAid Tomcat webapp paths and user.exe staging/launch actions.

PowerShell Script Evidence Eraser Searching for cleanLL and usersfiles.war

Identifies PowerShell script blocks containing evidence-cleanup indicators and a repeating while(1) loop.