Sigma detection rules, expert-reviewed

Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)

Alerts when proxy users download common malware and lure file types from hosts using suspicious TLDs.

Windows Named Pipe Creation Alert for Known Malicious Pipe Names

Alert on Windows named pipe creations where the PipeName matches known malware-associated pipe identifiers.

Windows Named Pipe Creation Matching Suspected Turla Pipe Names

Alert on Windows named pipe creation when the PipeName matches Turla-associated strings.

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Alerts on remote logons to admin-named accounts in Windows Security logs (4624, LogonType 10, Negotiate).

Proxy Web Requests for Flash Player Installer from Unofficial Locations

Flags proxy downloads for Flash Player installer paths when the request host is not ending in .adobe.com.

Windows: Detect Renamed ps.exe Executing netstat via cmd /c

Alerts on Windows executions of renamed PsTool-like ps.exe that include accept-eula and netstat via cmd.exe.

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Flags Word (WINWORD.EXE) spawning csc.exe, a suspicious execution pattern observed in some exploit chains.

Windows Registry Key Created: Sysinternals EULA Acceptance

Flags registry writes indicating Sysinternals EULA acceptance via a TargetObject ending with \EulaAccepted.

Windows: Command-line execution using Sysinternals -accepteula flag

Alerts on Windows processes launched with the -accepteula flag, often associated with Sysinternals tool execution.

Linux JexBoss Suspicious Bash Command Launch with /dev/tcp

Flags Linux executions containing bash -c /bin/bash paired with /dev/tcp/ indicative of a reverse-shell command sequence.

sshd Buffer Underflow Error Message Matching CVE-2018-15473 Exploit Attempt (Linux)

Flags Linux sshd pre-auth buffer parsing error messages that align with CVE-2018-15473 exploit attempts.

Windows WMI Persistence via Event Filter/Consumer Bindings and Filter Registration

Flags likely WMI-based persistence by spotting event filter/consumer bindings and WMI filter registrations tied to script/command-line consumers.

Windows WMI Persistence via Security Event 4662 on WMI subscription namespace

Alerts on Security Event 4662 indicating access to WMI Namespace objects with "subscription" in the name.

Linux Suspicious Shell Command Lines for Exploit/Payload Delivery

Detects Linux command-line strings matching wget/piping, payload staging, permission changes, and socat/HTTP server execution patterns.

Windows svchost.exe Spawned by Uncommon Parent Process

Alerts when svchost.exe starts with an unusual parent process name on Windows.