Sigma detection rules, expert-reviewed

DNS queries to known malicious C2 domains from axios/plain-crypto-js npm compromise indicators

Alerts on DNS queries to known malicious C2 domains tied to an Axios npm supply-chain compromise.

Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components

Flags Windows file creation of wt.exe/system.bat and temp .vbs/.ps1 payloads when created by node.exe or powershell.exe.

macOS: Axios NPM compromise file creation via curl and node indicators

Alerts on macOS file events matching curl and node staging paths linked to an Axios npm compromise pattern.

Linux file creation via curl to /tmp/ld.py (Axios NPM compromise indicators)

Alerts on Linux file creation of /tmp/ld.py by a /curl process, consistent with automated payload staging.

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Identifies Linux process executions matching indicators tied to backdoored LiteLLM v1.82.7/v1.82.8 credential-stealer and persistence activity.

Linux Persistence File Creation Targeting sysmon.py and systemd user service

Alerts on creation of user persistence files under sysmon.py or systemd user service paths by a process running from /python3.

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

Windows Process Creation: curl Uploads to File-Sharing Domains

Detects curl commands on Windows uploading files to common file sharing/upload domains.

Windows AppLocker Audit-Only Events Indicating What Would Be Blocked in Enforce Mode

Alerts on AppLocker audit-only reports that specific apps would have been blocked if enforcement rules were enabled.

Windows System Restore Registry Modification via PowerShell or reg.exe Command Line

Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.

Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Alerts on Windows Python command-line one-liners that import base64 and call decode functions.

Linux Process Execution of Python Base64 Decode One-Liners

Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.

Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows

Alerts when PowerShell script blocks reference Exchange inbox/rule cmdlets and forwarding/redirect parameters.

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

Suspicious File Creation by OpenEDR ITSMService on Windows

Alerts on Windows file creations by OpenEDR ITSMService.exe when the target ends with common executable or script/archive extensions.