Sigma detection rules, expert-reviewed

Windows Security 4625 Logon Failures to TargetUserName AAAAAAA Indicative of RDP Scan PoC

Alerts on Windows failed logon (4625) events matching a BlueKeep scanner PoC TargetUserName value.

Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56

Flags suspicious TermDD RDP error events (Event IDs 50/56) on Windows that may indicate CVE-2019-0708 activity.

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Alerts when a new process is spawned under a Terminal Services (termsvcs) host context in Windows.

Potential BearLPE Exploitation via Windows Task Scheduler schtasks.exe DACL Change

Flags schtasks.exe executions with /change, /TN, /RU, and /RP, consistent with task modification tied to BearLPE attempts.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

Windows Registry: Create/Modify CLSID/AppX keys associated with OceanLotus decoy paths

OceanLotus Registry Activity

Windows: Suspicious Service Installation via Registry ImagePath Outside system32

Alerts on NalDrv/PROCEXP152 service ImagePath registry entries configured outside the expected system32 driver path.

Windows Suspicious PROCEXP152.sys Creation in Local Temp Folder

Flags creation of PROCEXP152.sys in AppData\Local\Temp, excluding events from common Sysinternals executables.

Windows Security Event 4673: SeLoadDriverPrivilege Use by Non-Whitelisted Processes

Flags Windows Event 4673 instances where SeLoadDriverPrivilege is exercised, suggesting attempts to load or unload kernel-mode drivers.

Linux Command Lines Creating Symlink to /etc/passwd

Alerts on Linux command lines attempting to create symlinks to /etc/passwd via ln -s/ln -f patterns.