Sigma detection rules, expert-reviewed

Windows: Detects Access to ADMIN$ Network Share (Event 5140)

Alerts on Windows Security event 5140 entries where an access request targets the ADMIN$ share.

Windows process access targeting verclsid.exe with Office/VBA shellcode traces

Flags broad access to verclsid.exe from Microsoft Office/VBA contexts with VBE7.DLL call traces consistent with shellcode injection.

Linux Syslog Buffer Overflow Exploit Attempt Keywords

Alerts on Linux syslog entries containing known buffer overflow/stack-smashing attempt keyword patterns.

Linux ClamAV alerts for Trojan, Webshell, Rootkit, Htran, VirTool detections

Detects ClamAV log entries with keyword-based indicators for Trojans, webshells, rootkits, and Htran.

Apache worker crash logs with "Segmentation Fault" exit signal

Alerts on Apache error log lines showing a worker process crashed with an exit signal Segmentation Fault.

Windows LSASS Remote Thread Creation Indicative of Password Dumping

Flags Windows remote thread creation targeting lsass.exe, a common pattern in password dumping activity.

Windows Security: Suspicious Failed Logons Using Uncommon Status/Substatus Codes

Alerts on Windows failed logons (4625/4776) with specific restricted-status codes indicating potential account tampering or access probing.

Windows Security Event 4794 Password Change for DSRM Account

Flags potential changes to the DSRM administrator password on Windows domain controllers using Security EventID 4794.

Windows Security Events: SID History Added to Active Directory Object

Flags Windows Security events indicating Active Directory SIDHistory changes that can grant additional privileges.

Windows Application Logs: Match Antivirus Signature and Malware Keyword Hits

Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.

Windows Webshell Command Strings in Webserver GET Requests

Identifies GET requests with URL-encoded Windows command strings consistent with webshell behavior.

Windows Driver Load from Temporary Directory Paths

Detects Windows driver loads whose ImageLoaded path contains the temporary directory (\Temp\).

Windows Security: Detect LSASS handle access for SAM_DOMAIN (0x705)

Flags handle opens to lsass.exe with access mask 0x705 targeting SAM_DOMAIN, indicative of credential dumping.

Windows Kerberos TGT Issue Operations Failures (Event IDs 675/4768/4769/4771)

Alerts on Windows Security failures for Kerberos TGT-related operations using specific Kerberos event IDs and status codes.

Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)

Flags Windows Kerberos service ticket requests using RC4 encryption while excluding '$' machine/service accounts.