Sigma detection rules, expert-reviewed

Windows DLL Sideloading via SmadHook32c.dll and SmadHook64c.dll Loads

Alerts on non-standard loads of SmadHook32c.dll/SmadHook64c.dll on Windows, consistent with potential DLL sideloading.

Windows: PowerShell Core DLL Loaded by Office Application

Flags Office apps that load System.Management.Automation DLLs associated with PowerShell Core.

Windows: Detect Loading amsi.dll by LOLBIN Processes

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

Windows File Creation: __PSScriptPolicyTest_ PowerShell Test Script Written by Uncommon Process

Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.

Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing

Alerts on proxy requests to specific suspect C2-related domains by host substring match.

Suspicious DNS Queries to Operation Triangulation-Like Domains for C2 Beaconing

Detects DNS queries to known Operation Triangulation-related domains that may indicate C2 beaconing.

Windows: Detect w3wp.exe launching csc.exe for Dynamic Compilation (MOVEit CVE-2023-34362)

Flags IIS (w3wp.exe) spawning csc.exe within a MOVEit pool, consistent with dynamic compilation activity.

Windows File Activity Indicators of Potential MOVEit Transfer CVE-2023-34362 Exploitation

Finds MOVEit Transfer webroot file and ASP.NET compilation artifacts on Windows that may indicate CVE-2023-34362 exploitation.

Linux process-created writes to sensitive or critical files via shell redirection or editors

Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.

Webserver: Potential CVE-2023-25717 Ruckus Wireless Admin Injection via Unauthenticated HTTP GET

Alerts on suspicious GET requests to Ruckus Wireless Admin login endpoints containing '$(' payload markers.

Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.

Windows regsvr32 Execution from Suspicious DLL Paths

Alerts on regsvr32 runs whose command line references a DLL in highly suspicious Windows directories.

Windows regsvr32 Execution with DLL Path in Common Temporary/Public Directories

Alert on regsvr32.exe runs whose command line points to DLLs in Temp/Public-style directories.

Windows regsvr32 Execution of calc with /s flag

Alerts on regsvr32.exe runs using /s with a command line ending in calc.

Suspicious Windows regsvr32 Command-Line Uses FTP/HTTP to Register Remote Components

Alerts on regsvr32 command lines using /i flags with ftp/http content, consistent with remote DLL registration.