Sigma detection rules, expert-reviewed

Windows Driver File MoriyaStreamWatchmen.sys Created in System32\drivers

Alerts when the Windows system32 drivers directory receives the MoriyaStreamWatchmen.sys file.

Windows whoami.exe Privilege Enumeration Using /priv Flag

Alerts on whoami.exe runs with /priv or -priv to enumerate current user privileges.

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

Windows Pingback backdoor via ICMP C2 using updata.exe command-line parameters

Flags Windows process creation where updata.exe spawns msdtc config start auto commands consistent with Pingback backdoor.

Windows DLL Loading of C:\Windows\oci.dll by msdtc.exe

Flags msdtc.exe loading C:\Windows\oci.dll, consistent with Pingback backdoor DLL loading behavior.

Windows File Indicator for Pingback Backdoor updata.exe Writing oci.dll

Alerts on updata.exe creating or modifying C:\Windows\oci.dll as a Pingback backdoor file indicator.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows Security: Hidden Local User Account Creation (Event ID 4720)

Alerts on Windows 4720 local user creation for hidden accounts (username ending with '$'), excluding 'HomeGroupUser$'.

Windows Process Access to svchost.exe with Credential Dumping Access Rights

Alerts on attempts to read svchost.exe memory consistent with credential dumping, excluding known benign callers.

PowerShell Defender Exclusion via Set/Add-MpPreference Command-Line Flags (Windows)

Detects PowerShell commands that add or set Microsoft Defender exclusions using Add/Set-MpPreference parameters.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate

Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.

Azure Hybrid Connection Manager DNS Queries for servicebus.windows.net (Windows)

Flags HybridConnectionManager-initiated DNS queries to servicebus.windows.net on Windows.

Windows Hybrid Connection Manager Service Activity (Event IDs 40300-40302)

Flags Windows Hybrid Connection Manager-related events mentioning sb:// and servicebus.windows.net.