Sigma detection rules, expert-reviewed

Windows DNS Query for _ldap.* Using LDAP-Related Discovery

Alerts on _ldap.* DNS queries from uncommon Windows processes, indicating potential LDAP/DNS service discovery.

Windows Command-Line Tools Performing Web POST Exfiltration via IWR/curl/wget

Identifies PowerShell/curl/wget commands on Windows that use POST-style web requests combined with data-dumping or discovery payloads.

Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns

Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.

Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution

Alerts on execution of Sysinternals PsService (PsService*.exe) on Windows, which can support service discovery and tampering.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

Windows Process Creation: gpresult.exe Group Policy (RSoP) Discovery (/z /v)

Flags process executions of gpresult.exe that request RSoP details using /z and /v on Windows.

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows PowerShell: Suspicious Process Discovery Using Get-Process

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

Windows CHCP Console Code Page Lookup Triggered From cmd.exe

Flags cmd.exe-launched chcp.com executions likely used to query system code page/locale for discovery.

Microsoft 365 eDiscovery PST Export or Search Started Success Alert

Alerts on successful eDiscovery search/export activity that produces PST files in Microsoft 365.

Windows Process Command Line Network Recon via nslookup LDAP SRV Query

Identifies Windows command lines running nslookup with an LDAP SRV domain controller discovery query string.

Windows Process Creation: Suspicious systeminfo.exe Execution

Alerts on execution of systeminfo.exe (or sysinfo.exe) via Windows process creation logs for system discovery.

Windows: Suspicious Process Execution of hostname.exe

Flags execution of hostname.exe from process creation events on Windows for discovery activity.