Sigma detection rules, expert-reviewed

Linux dd Process Memory Map Overwrite for Code Injection (proc/mem)

Alerts when dd is used to write to /proc/<pid>/mem, suggesting potential Linux process code injection.

Windows Registry Set in Shell Open Command Using PowerShell Cryptography .NET Classes

Flags registry set of \Shell\Open\Command where PowerShell references System.Security.Cryptography crypto classes.

PowerShell Crypto Namespace Class Invocation for Windows Process Creation

Alerts on PowerShell executions that reference System.Security.Cryptography and common crypto class names.

Windows Registry: Netsh Helper DLL value added under SOFTWARE\Microsoft\NetSh

Alerts on Windows registry writes under SOFTWARE\Microsoft\NetSh that add .dll helper entries.

Windows: Netsh helper DLL registration via suspicious registry paths

Flags Netsh helper DLL registration when the DLL path is found in suspicious user/temp-like registry details on Windows.

Windows ImageLoad: Uncommon Process Loads RstrtMgr.dll (Restart Manager)

Alerts on non-standard processes loading RstrtMgr.dll using Windows image load telemetry.

Windows Image Load of RstrtMgr.dll by Suspicious Path or User Content

Alerts on RstrtMgr.dll loading from suspicious path contexts using Windows image load telemetry.

Detect CVE-2023-4966 Citrix ADC Sensitive Info Disclosure Attempts in Webserver Logs via Long Host Header

Alerts on GET requests to the OpenID configuration endpoint with an unusually long Host header, indicative of CVE-2023-4966 probing.

CVE-2023-4966 Sensitive Info Disclosure Attempt on Citrix ADC via Webserver Logs

Alerts on successful GET requests to the OIDC openid-configuration path that match CVE-2023-4966 related probing patterns.

Citrix ADC Proxy Log Detection for CVE-2023-4966 Sensitive Info Disclosure Attempts via OIDC Endpoint

Alerts on successful GETs to /oauth/idp/.well-known/openid-configuration in Citrix ADC proxy logs consistent with CVE-2023-4966 probing.

Citrix ADC CVE-2023-4966 Proxy Exploitation Attempt via Oversized Host Header (GET /oauth idp well-known)

Flags proxy GETs to the OpenID configuration endpoint with an excessively long Host header consistent with CVE-2023-4966 probing.

Python-Based Tool LSASS Process Access for Credential Dumping (Windows)

Alerts on process-access attempts to lsass.exe with a Python-related call trace and high granted access.

Windows HackTool Process Access: Detect Access by Common Tool Image Names

Alerts on Windows process access events initiated by processes whose image names match common credential/dumping hack tools.

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Flags Splunk web exploitation patterns for CVE-2023-46214 using shell.xsl uploads followed by search-result URIs.

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Alerts on POST web requests to .xsl endpoints with NO_BINARY_CHECK=1 and input.path, returning 200/302—consistent with a CVE-2023-46214 probe.