Sigma detection rules, expert-reviewed

dfsvc.exe Initiated Network Connection to Uncommon Ports (Windows)

Alerts on dfsvc.exe-initiated outbound connections targeting non-standard ports on Windows, excluding typical 80/443 and IPv6 DNS(53).

dfsvc.exe Initiated Network Connections to External (Non-Local) IPs on Windows

Alerts on dfsvc.exe initiating outbound connections to IPs outside local/private and link-local ranges.

Windows: Uncommon Child Processes Spawned by SndVol.exe

Alerts when SndVol.exe launches unusual child processes, using Windows process creation logs.

Windows: Potential RjvPlatform.dll DLL Sideloading via SystemResetPlatform.exe from Non-Default Path

Flags SystemResetPlatform.exe loading RjvPlatform.dll from a non-default location, indicating possible DLL sideloading.

Windows: RjvPlatform.dll loaded by SystemResetPlatform.exe from $SysReset path

Alerts on SystemResetPlatform.exe loading RjvPlatform.dll from the $SysReset Framework Stack path on Windows.

Windows DLL Sideloading Suspicion via edputil.dll Image Load

Alerts on edputil.dll image loads occurring outside standard Windows system directories, suggesting possible DLL side-loading.

Windows DLL Sideloading Indicators: 7za.dll Loaded from Non-Program Files Paths

Alerts when a process loads 7za.dll from a non-Program Files path, indicating potential DLL sideloading.

Linux sshd Logs: Flag Failed Curve25519 Key Generation Indicative of libSSH CVE-2023-2283 Attempts

Alerts on sshd log entries with 'Failed to generate curve25519 keys' that may indicate CVE-2023-2283 libssh bypass attempts.

Windows ClickOnce Loads Unsigned or Expired Signed Modules from User Apps Path

Alerts when a ClickOnce app loads a module from Apps\2.0 that is unsigned or has an expired signature.

Windows Registry COM InProcServer32 Hijack via PSFactory CLSID Default Value

Detects suspicious modifications to a PSFactory COM InProcServer32 (Default) registry value that may enable COM-based persistence.

Windows Code Integrity: Kernel Module Loaded Without WHQL Requirements (Event 3082/3083)

Alerts when Code Integrity logs show loaded kernel modules failing WHQL compliance (Event 3082/3083), excluding selected VMware drivers.

Windows Code Integrity Operational: Unsigned Image Loaded

Alerts on Windows Code Integrity detecting that an unsigned image was loaded (Event ID 3037).

Windows Code Integrity Unsigned Kernel Module Loaded (Event ID 3001)

Alerts on Windows Code Integrity reporting an unsigned kernel module load via Event ID 3001.

Windows Code Integrity: Revoked Signed Image Loaded (Event 3032/3035)

Alerts on Code Integrity events showing a revoked signed image was loaded, including debugger-allowed cases.

Windows Code Integrity blocks image load when signing certificate is revoked (Event ID 3036)

Alerts on Windows Code Integrity Event ID 3036 when image loads are blocked because the signing certificate is revoked.