Sigma detection rules, expert-reviewed

Windows Process Creation Matching TrustedPath UAC Bypass Directory Mocking Strings

Alerts on Windows processes referencing System32/SysWOW64 paths consistent with TrustedPath UAC bypass directory mocking.

MODX Manager Path Traversal Attempt via tvs.php class_key (CVE-2010-5278)

Alerts on HTTP requests to MODx tvs.php with traversal-based class_key payload indicative of LFI attempts.

Web Exploitation of Arcadyan Router Path Traversal and Config Injection Attempts

Detects Arcadyan router exploit traffic by matching URL-encoded path traversal patterns in query strings linked to config injection.

Exchange Management: Certificate CSR exported to webserver or .aspx-named path

Flags Exchange CSR export commands that write request files to C$ and web-root paths or use an .aspx filename.

Fortinet WAF: Detect POST to /api/v2.0/user/remoteserver.saml (CVE-2021-22123 attempt)

Flags suspicious Fortinet WAF HTTP POST requests targeting a remoteserver.saml API query pattern consistent with CVE-2021-22123 exploitation.

Windows whoami.exe Renamed Execution via Mismatched OriginalFileName

Alerts when a renamed process still reports OriginalFileName as whoami.exe on Windows.

Windows SystemNightmare Exploitation Attempt via PrintNightmare Command Lines

Alerts on Windows process command lines matching SystemNightmare/PrintNightmare exploitation indicators that may enable LOCAL_SYSTEM shell access.

Exchange ProxyLogon activity: IIS POST SetObject Reset VirtualDirectory requests

Alerts on successful POSTs to ECP DDIService SetObject resetting a VirtualDirectory with a '$' username suffix.

Microsoft Exchange: Mailbox export to UNC path or .aspx filename with possible role assignment

Flags Exchange mailbox export commands targeting UNC paths with .aspx or granting the Mailbox Import Export role.

Windows Exchange Management: Set-OabVirtualDirectory after ProxyLogon exploitation

Flags Exchange management command lines invoking Set-OabVirtualDirectory with suspicious external URL/script injection patterns.

Successful ProxyShell-like Exchange exploitation via autodiscover.json and PowerShell/MAPI paths

Flags Exchange-targeted web requests with /autodiscover.json plus exploit URI fragments returning 200/301.

Windows Named Pipe Creation Matching Cobalt Strike Malleable C2 Profile Patterns

Alerts on Windows named pipe creation with PipeName patterns consistent with Cobalt Strike Malleable C2 behavior.

Windows Hacktool Execution Indicators for SMB/NTLM Relay and Potato-Style Privilege Escalation

Alerts on Windows execution of common SMB/NTLM relay and “Potato” privilege escalation hacktool indicators via process creation fields.

Windows Registry Modification Indicative of CVE-2021-31979 and CVE-2021-33771 Exploitation

Flags registry changes to targeted COM InprocServer32 CLSID paths tied to CVE-2021-31979/33771 exploitation behavior on Windows.

Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths

Flags Windows file events where the target filename matches paths tied to CVE-2021-31979/CVE-2021-33771 exploitation patterns.