Sigma detection rules, expert-reviewed

Linux Email Exfiltration Staging File Pattern Matching (/mail/tmp/**.tar.gz)

Flags Linux file events creating /mail/tmp staging archives named like abc123.tar.gz.

Windows Virtual Smart Card Created Using TpmVscMgr.EXE

Flags execution of Tpmvscmgr.exe with a create command, indicating creation of a new virtual smart card.

Windows: Detect lodctr.exe Rebuild (-r) Performance Counter Values

Flags lodctr.exe executions with -r, indicating attempts to rebuild performance counter registry values.

Windows VMwareToolBoxCmd.exe Script/Set Execution Used for VM State Persistence

Alerts on VMwareToolBoxCmd.exe launched with script/set flags and command-line hints of a suspicious VM state persistence setup.

Windows: VMwareToolBoxCmd.exe script/set Used to Configure VM State Persistence

Flags VMwareToolBoxCmd.exe use of 'script' and 'set' parameters consistent with VM state–based persistence.

Windows DLL Sideloading: waveedit.dll Loaded by Nero WaveEditor

Alerts when waveedit.dll is loaded from an unexpected path, suggesting possible DLL sideloading on Windows.

Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER

Alerts on GET requests to GeoServer OWS with CQL_FILTER containing SQLi-style payload markers and functions.

Windows Registry: ClickOnce Trust PromptingLevel Set to Enabled for Multiple Locations

Alerts on Enabled ClickOnce trust prompting registry changes for Internet and related locations.

Suspicious Child Process Spawned by ClickOnce Application (Windows)

Alerts when a ClickOnce app under AppData\Local\Apps\2.0\ spawns common script/tool executables.

Windows ClickOnce Execution: dfsvc.exe Child Process Launch

Flags ClickOnce-style child processes spawned by dfsvc.exe from the AppData\Local\Apps\2.0\ directory on Windows.

dfsvc.exe Initiated Network Connection to Uncommon Ports (Windows)

Alerts on dfsvc.exe-initiated outbound connections targeting non-standard ports on Windows, excluding typical 80/443 and IPv6 DNS(53).

dfsvc.exe Initiated Network Connections to External (Non-Local) IPs on Windows

Alerts on dfsvc.exe initiating outbound connections to IPs outside local/private and link-local ranges.

Windows: Uncommon Child Processes Spawned by SndVol.exe

Alerts when SndVol.exe launches unusual child processes, using Windows process creation logs.

Windows: Potential RjvPlatform.dll DLL Sideloading via SystemResetPlatform.exe from Non-Default Path

Flags SystemResetPlatform.exe loading RjvPlatform.dll from a non-default location, indicating possible DLL sideloading.

Windows: RjvPlatform.dll loaded by SystemResetPlatform.exe from $SysReset path

Alerts on SystemResetPlatform.exe loading RjvPlatform.dll from the $SysReset Framework Stack path on Windows.