Sigma detection rules, expert-reviewed

Windows: Recon command output piped to findstr.exe

Alerts on Windows command lines running recon commands whose output is filtered with findstr.exe.

PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging

Identifies PowerShell script blocks querying sensitive registry keys tied to services and Run/Explorer/winlogon locations.

Windows process creation: WerFault.exe executed with -pr flag

Alerts when WerFault.exe is launched with the -pr argument, potentially indicating ReflectDebugger-based execution.

Windows PowerShell Decryption-Like Activity Involving .LNK File Processing

Identifies PowerShell runs that enumerate and process *.lnk content using byte-level reads/writes consistent with decryption staging.

Windows Process Execution of curl.exe with --insecure Flag

Flags curl.exe launched with --insecure/-k to disable TLS certificate verification.

Windows Registry: Uncommon Microsoft Office Trusted Location Path Added

Alerts on registry changes adding non-standard Microsoft Office Trusted Location paths that could undermine macro security.

Windows Registry TrustRecords Change for Macro-Enabled Documents in Suspicious Paths

Alert on Windows registry changes to Office TrustRecords where trusted-document paths fall in suspicious directories.

Windows: Office Executable Running a Document from Trusted Template/Startup Paths

Alerts when Office apps are launched with command lines pointing to documents under Office template/Startup paths.

Windows Registry: Microsoft Office Trusted Location Keys Updated

Alerts on Office “Trusted Locations” registry changes, excluding typical Click-to-Run and Office install activity.

Windows rundll32.exe Using ShellExecute via ShellDispatch.dll Functionality

Alerts on rundll32.exe command lines referencing RunDll_ShellExecuteW, suggesting ShellDispatch.dll ShellExecute-based execution.

Windows ShellDispatch.dll DLL Sideloading via Image Load Monitoring

Alerts on suspicious loads of ShellDispatch.dll on Windows when not occurring in expected temp directories.

Windows DLL side-loading via appverifUI.dll image loads

Alerts when appverifUI.dll is loaded on Windows from unexpected paths, a common DLL sideloading technique.

Windows Security 4719: Important Audit Policy Categories Disabled

Alerts on Windows Security 4719 indicating auditing was disabled for important security event subcategories.

Linux Named Pipe Creation via mkfifo in /tmp

Flags mkfifo executions that create named pipes in /tmp, a commonly abused location.

Linux Named Pipe Creation via mkfifo Process Execution

Flags Linux process executions of /mkfifo that create named pipes.