Sigma detection rules, expert-reviewed

Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot

Identifies Linux shutdown/reboot command execution patterns using auditd execve telemetry.

Linux: Grep used to search for passwords in files (auditd EXECVE)

Flags Linux process executions running grep with “password” in the command line.

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Alerts on touch executions with timestamp options that alter file access and modification times on Linux.

Windows: Malicious Child Process Execution via vsjitdebugger.exe Just-In-Time Debugger

Flags unusual executables launched by vsjitdebugger.exe on Windows, excluding common Visual Studio helper/debugger children.

Windows Process Execution Proxy Using SyncInvoke in CL_Invocation.ps1

Alerts on Windows command lines containing "SyncInvoke" consistent with CL_Invocation.ps1 execution proxy behavior.

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

macOS Network Sniffing Tool Execution via tcpdump or tshark

Identifies macOS execution of tcpdump or tshark, indicating potential network traffic sniffing activity.

macOS Startup Item Plist Created in StartupItems Folders

Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.

Windows Registry-Based DLL Hijack via WAB.EXE Using WAB Registry DLLPath

Flags WAB.EXE DLLPath registry writes where the configured DLL path differs from the default.

Windows Process Creation: accesschk.exe Permission Audit Execution

Flags AccessChk (accesschk.exe) permission/audit executions using common query flags in Windows process creation logs.

Windows te.exe Execution of Test Components (TAEF) via Process Creation

Alerts on process activity involving te.exe, which may indicate TAEF-based execution of malicious test components.

Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell

Flags installer-initiated spawning of cmd.exe or PowerShell from Windows\Installer temporary msi-related processes.

Detect Elevated Windows Installer (msiexec) Running as SYSTEM

Flags msiexec.exe MSI activity from Windows Installer running with SYSTEM integrity, excluding known benign parent contexts.

Windows PowerShell via sqltoolsps.exe (sqltoolsps.exe child process exclusion)

Flags suspicious sqltoolsps.exe executions that may launch PowerShell, excluding cases where smss.exe spawned the utility.

Windows manage-bde.wsf via wscript/cscript Proxy Execution

Flags Windows process executions where wscript/cscript runs manage-bde.wsf, indicating potential proxy execution via LOLBIN.