Sigma detection rules, expert-reviewed

Suspicious DNS Queries to Operation Triangulation-Like Domains for C2 Beaconing

Detects DNS queries to known Operation Triangulation-related domains that may indicate C2 beaconing.

Windows: Detect w3wp.exe launching csc.exe for Dynamic Compilation (MOVEit CVE-2023-34362)

Flags IIS (w3wp.exe) spawning csc.exe within a MOVEit pool, consistent with dynamic compilation activity.

Windows File Activity Indicators of Potential MOVEit Transfer CVE-2023-34362 Exploitation

Finds MOVEit Transfer webroot file and ASP.NET compilation artifacts on Windows that may indicate CVE-2023-34362 exploitation.

Linux process-created writes to sensitive or critical files via shell redirection or editors

Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.

Webserver: Potential CVE-2023-25717 Ruckus Wireless Admin Injection via Unauthenticated HTTP GET

Alerts on suspicious GET requests to Ruckus Wireless Admin login endpoints containing '$(' payload markers.

Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.

Windows regsvr32 Execution from Suspicious DLL Paths

Alerts on regsvr32 runs whose command line references a DLL in highly suspicious Windows directories.

Windows regsvr32 Execution with DLL Path in Common Temporary/Public Directories

Alert on regsvr32.exe runs whose command line points to DLLs in Temp/Public-style directories.

Windows regsvr32 Execution of calc with /s flag

Alerts on regsvr32.exe runs using /s with a command line ending in calc.

Suspicious Windows regsvr32 Command-Line Uses FTP/HTTP to Register Remote Components

Alerts on regsvr32 command lines using /i flags with ftp/http content, consistent with remote DLL registration.

Windows DNS Server: Failed DNS Zone Transfer Requests (Event ID 6004)

Alerts on Windows DNS Server Event ID 6004 indicating a failed DNS zone transfer request for a non-existent or non-authoritative zone.

Windows Rundll32 Execution via Suspicious DLL Path Without .dll Extension

Alerts when rundll32.exe is started from suspicious parent scripts with a DLL-like path missing the .dll extension.

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories

Alerts on rundll32.exe execution with DLL arguments from common Windows script/LOLBins and suspicious staging paths.

Windows Registry: New ODBC Driver Registration in Suspicious Path

Alerts when Windows registers a new ODBC driver under the ODBCINST.INI area with details pointing to suspicious filesystem paths.