Sigma detection rules, expert-reviewed

Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

Alerts on Linux execve events launching zip, gzip (-k), or tar create commands often used to compress data.

PowerShell Compress-Archive Cmdlet Execution for Data Compression

Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.

Windows Process Creation: Suspicious Command-Line Parameters for 7-Zip/RAR Executables

Detects 7z/rar executions on Windows with suspicious switches like password and delete options.

Linux Sudo Privilege Escalation Attempt Matching CVE-2019-14287 Command-Line Pattern

Alerts on Linux process command lines containing ' -u#' indicative of sudo CVE-2019-14287 exploitation attempts.

Linux sudo CVE-2019-14287 exploit attempt via unusual USER strings

Alerts on sudo events with USER values matching patterns linked to CVE-2019-14287 exploit attempts.

Windows Process Creation: Suspicious CHCP Code Page Switch to Rare Locale

Alerts on suspicious chcp.com usage that switches Windows code pages to specific rare identifiers in process creation logs.

Windows Registry: Suspicious Keyboard Layout Preload in User Session

Detects user-hive registry changes that preload Persian (Iranian) or Vietnamese keyboard layouts under Windows.

Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution

Flags psr.exe launched with /start or -start, indicating potential user screen and click recording.

Windows OpenWith.exe Launches Another Binary via /c

Flags Windows OpenWith.exe executions that include '/c', indicating it launched another binary.

Windows Devtoolslauncher.exe LaunchForDeploy Executes a Specified Binary

Alerts when devtoolslauncher.exe runs with LaunchForDeploy, indicating it may launch another binary on Windows.

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution

Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.

PowerShell module: Obfuscated Invoke via rundll32/shell32.dll comspec iex patterns

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

Windows regsvr32 DLLLoad from AppData Local containing DllEntry

Alerts when regsvr32 loads a DLL from AppData\Local with a DllEntry reference.