Sigma detection rules, expert-reviewed

Windows Registry Screensaver Path Value Modified (SCRNSAVE.EXE)

Alerts on registry changes to the SCRNSAVE.EXE screensaver binary path under HKCU.

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

Windows Process Creation: Detect Reversed PowerShell Command Tokens in CommandLine

Alerts on suspicious reversed token usage in PowerShell command lines on Windows, excluding -EncodedCommand / -enc.

PowerShell ConvertTo-SecureString Cmdlet Execution from Command Line (Windows)

Alerts when PowerShell is launched with a command line containing ConvertTo-SecureString, a credential-related cmdlet uncommon in normal execution.

Windows msbuild.exe Network Connections to Ports 80/443

Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.

macOS Local Group Enumeration via dscacheutil, cat /etc/group, or dscl

Flags macOS process executions that enumerate local system groups using dscacheutil, cat, or dscl commands.

macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths

Flags macOS rm/unlink/shred commands targeting /var/log or ~/Library/Logs to remove local log evidence.

Linux Local Groups Discovery via /groups or /etc/group File Enumeration

Detects Linux commands and utilities used to enumerate local groups and read /etc/group.

PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

PowerShell Root Certificate Added via LocalMachine\Root Path

Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)

Detects dscl commands on macOS creating hidden users (UniqueID < 500 or IsHidden true).

Windows verclsid.exe executes COM object via GUID parameters

Flags verclsid.exe process launches using /S /C COM GUID-style arguments on Windows.

Windows: Identify RpcPing.exe -s RPC test that requests NTLM authentication

Detects RpcPing.exe RPC test usage with parameters indicating NTLM authentication attempts.

Windows Renamed ftp.exe Execution via OriginalFileName PE Metadata

Flags Windows executions where PE OriginalFileName is ftp.exe but the image path is not named ftp.exe.