Sigma detection rules, expert-reviewed

Web server requests targeting WebLogic JNDI LDAP via JndiBindingHandle (CVE-2021-2109)

Alerts on GET requests with WebLogic JndiBindingHandle and an ldap:// payload targeting AdminServer.

Windows PowerShell Command Lines with WMI Process Creation and rundll32 Invocation

Flags Windows command lines where PowerShell/WMI is used to spawn rundll32 from c:\windows.

Windows Plink Remote Port Forwarding via -R Command Line

Alerts on Windows process command lines using Plink " -R " remote port forwarding to a local port.

Windows System Log: NTFS File System Driver Event 55 Indicates Possible NTFS Exploitation

Alerts on Windows NTFS Event ID 55 indicating a corrupted file record with a matching filename string in the event description.

Windows Registry Persistence via VSTO Add-ins in Microsoft Office

Flags registry writes that register VSTO/Office add-ins for Outlook, Word, Excel, or PowerPoint persistence on Windows.

Cisco ASA FTD web exploitation attempt matching CVE-2020-3452 with HTTP 200

Detects HTTP 200 requests targeting Cisco ASA/FTD web parameters associated with CVE-2020-3452 exploit behavior.

SolarWinds Orion Web API auth bypass probing via suspicious WebResource requests

Detects likely SolarWinds Orion API authentication bypass probing by matching suspicious WebResource/i18n endpoint query strings while filtering known valid requests.

Windows rundll32.exe Command-Line RunDLL or Control_RunDLL Execution

Alerts on rundll32.exe process launches whose command lines end with RunDLL/Control_RunDLL, indicative of DLL function loading.

Windows Process Creation Alerts for Suspicious Lazarus-Linked Command-Line Execution

Alerts on Windows process executions with command-line substrings consistent with behaviors described in Lazarus activity reports.

Detect SolarWinds SUPERNOVA Webshell URL Access on Webservers (logoimagehandler.ashx)

Identifies webserver traffic consistent with SUPERNOVA webshell access targeting logoimagehandler.ashx with a clazz query parameter.

Windows: Suspicious Child Processes Spawned by sqlservr.exe

Alerts when SQL Server (sqlservr.exe) spawns suspicious command/system tools on Windows.

Fortinet SSL VPN Exploitation Attempt via Path Traversal in Web Requests (CVE-2018-13379)

Alerts on HTTP requests matching a Fortinet SSL VPN traversal-style query indicative of CVE-2018-13379 exploitation.

Windows Process Tree: rundll32.exe launching wermgr.exe via DllRegisterServer

Flags rundll32.exe spawning wermgr.exe where rundll32 command line includes DllRegisterServer.

Web server request pattern consistent with Oracle WebLogic CVE-2020-14882 exploitation

Detects WebLogic console exploitation attempts by matching encoded traversal patterns in HTTP URI query strings.

Windows Registry Run Key Modification via winekey or team9 backdoor

Detects registry Run key changes to "Backup Mgr" that may indicate persistence via winekey/team9.