Sigma detection rules, expert-reviewed

Detect VAR++ LAUNCHER-Style Obfuscated PowerShell Command Block

Detects VAR++ LAUNCHER-like PowerShell obfuscation patterns in ScriptBlockText.

PowerShell Script Block Obfuscation via cmd/clipboard and clip.exe execution

Identifies obfuscated PowerShell script blocks launching clip.exe and chaining clipboard-related execution.

PowerShell Module: VAR++ LAUNCHER Obfuscation in Obfuscated Command Payload

Identifies obfuscated PowerShell module payloads matching a VAR++ LAUNCHER-style invocation pattern.

PowerShell Module: Obfuscated Clip.exe launcher using cmd with clipboard download payload

Detects obfuscated PowerShell module commands that run cmd with clip.exe/clipboard payload formatting.

Windows System: Detects Service Control Manager spawning obfuscated PowerShell via VAR++ LAUNCHER

Flags newly created Windows services whose ImagePath contains cmd chaining and obfuscated PowerShell launcher indicators.

Windows System Service Control: Obfuscated cmd Launching clip.exe for PowerShell

Flags service creation (Event 7045) with obfuscated cmd ImagePath using clip.exe/clipboard PowerShell execution patterns.

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Identifies Windows Zerologon exploitation attempts tied to Kali-hosted activity and mimikatz-related keywords.

Windows Security 4697 Alert for Obfuscated PowerShell Invoke via VAR++ LAUNCHER

Alerts on obfuscated PowerShell launcher patterns in Windows service creation events (EID 4697) consistent with VAR++ LAUNCHER.

Windows Security Log: Obfuscated cmd Execution of clip.exe via PowerShell Clipboard Patterns (EID 4697)

Alerts on service creation (Windows 4697) with CLIP.exe command-line patterns that indicate obfuscated PowerShell execution.

macOS Screen Capture via /usr/sbin/screencapture Process Execution

Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.

macOS GUI Credential Prompt Capture via osascript

Flags osascript command lines that script system dialogs referencing authentication and password-related terms.

Linux: Detect dd and truncate used to pad binaries and alter file contents

Flags Linux process executions of dd and truncate consistent with padding binaries to alter on-disk representation.

Windows Proxy Execution via wuauclt.exe (UpdateDeploymentProvider/RunHandlerComServer)

Alerts when wuauclt.exe is executed with UpdateDeploymentProvider/RunHandlerComServer-related parameters indicative of proxy execution.

Windows WMIC process creation with suspicious command execution

Alerts on WMIC spawning new processes with command-line indicators of common execution/payload binaries on Windows.

Windows regini.exe Used to Modify Registry via Alternate Data Streams (ADS)

Alert on regini.exe process executions whose command line contains an ADS-style colon pattern used for registry modification.