Sigma detection rules, expert-reviewed

Windows DNS Server error when loading ServerLevelPlugin DLL fails

Flags Windows DNS Server errors where the ServerLevelPluginDLL plugin DLL fails to load.

Windows Rundll32 DLL Load via control.exe spawning

Alerts on control.exe spawning rundll32.exe to load Shell32.dll via DLL invocation patterns.

Firewall Alerts for C2 IP Traffic to 69.42.98.86 and 89.185.234.145

Alerts when firewall traffic involves the two specified IPs associated with presumed C2 communication.

Windows Security: AD user/computer backdoor via msDS-AllowedToDelegateTo and delegation attributes

Alerts on AD delegation-related attribute changes that may create credentialless account control paths.

PowerShell Credential Prompt via PromptForCredential

Flags PowerShell scripts that reference "PromptForCredential", indicating credential prompt behavior in Script Block Logging.

Linux Command-Line Indicators of Equation Group Tooling

Flags execution of known suspicious Linux shell command patterns tied to Equation Group-style scripting and tooling.

Windows CScript and csvde Command-Line Execution Patterns Suggesting Cloud Hopper Activity

Detects cscript VBScript shell execution and csvde writing log files into C:\windows\web\.

Windows Service Install (Event ID 7045) for srservice, ipvpn, hkmsvc

Alerts on Windows service creation events (7045) for srservice, ipvpn, and hkmsvc service names.

Windows Service Creation: ServiceName javamtsup (Event ID 4697)

Flags Windows Security Event 4697 when a service named "javamtsup" is installed, indicating potential persistence.

Linux Log File Alerts for Suspicious Messages

Generates alerts when Linux log text contains suspicious keywords indicating possible network, service, or logging disruption.

PowerShell downgrade indicators via EngineVersion=2. and HostVersion !=2. (Windows)

Detects PowerShell version mismatches that may indicate a downgrade attempt using EngineVersion vs HostVersion telemetry.

Windows Registry UAC Bypass via Event Viewer Command Key (mscfile shell open command)

Alerts on registry changes to the mscfile shell open command key consistent with an Event Viewer UAC bypass technique.

Windows Event Viewer (eventvwr.exe) Spawns Suspicious Child Processes

Alerts when eventvwr.exe spawns unusual child processes in Windows process creation logs.

Windows Network Connections to Uncommon Ports (8080, 8888)

Flags Windows-initiated connections to ports 8080/8888 excluding private/local IPs and Program Files binaries.

Windows Network Connections to Known Malware Callback Ports (Suspicious Destination Ports)

Flags Windows processes initiating outbound connections to malware callback ports, excluding local/private IP ranges.