Sigma detection rules, expert-reviewed

Windows Security: Member Added to Security-Enabled Global Group

Alerts when Windows logs show a user was added to a security-enabled global group via Event ID 4728 or 632.

Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)

Detects hidden PowerShell downloading a setup.msi and silent msiexec installation tied to PaperCut MF/NG exploitation indicators.

Suspicious Windows Network Connections to External IP Lookup Service APIs

Alerts on non-browser outbound connections from Windows hosts to public IP lookup API domains.

Linux Process Creating xterm Reverse Shell Display Tunneling

Alerts on xterm processes started with -display and display endpoint ":1" consistent with a reverse shell tunnel.

Linux Python Reverse Shell via pty and socket Module Execution

Alerts on Linux executions of Python -c commands that use socket and pty to connect and spawn a potential reverse shell.

Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line

Alerts when PowerShell executes web-request aliases targeting direct IP URLs, indicating possible remote content access.

Windows Application: MSMQ Corrupted Packet (Event ID 2027, Level 2)

Alerts on MSMQ Event ID 2027 (level 2) indicating corrupted packets received by the service.

Windows Scheduled Task Creation with Schtasks -XML Using Non-.xml File

Alerts when schtasks.exe creates a scheduled task using -XML but the referenced file does not end with .xml.

Windows: Suspicious child processes spawned by pc-app.exe (PaperCut MF/NG potential exploitation)

Alert on pc-app.exe spawning common command or scripting utilities on Windows.

Windows: Detect suspicious PowerShell/Lsass tool execution launched by ManageEngine (ServiceDesk)

Alerts on suspicious child PowerShell/LSASS/tool activity launched by ManageEngine ServiceDesk (Java parent) on Windows.

Windows Log4j/Wstomcat-related Process Execution via ws_tomcatservice.exe Parent

Detects processes spawned by ws_tomcatservice.exe on Windows, excluding repadmin.exe, to surface potential Tomcat exploitation.

Windows Process Creation: AsperaFaspex Parent Spawning PowerShell or Credential-Access Tooling

Detects AsperaFaspex (aspera\ruby parent) spawning suspicious PowerShell, LSASS, web download, privilege, or defensive-evasion commands on Windows.

Windows RDP client Mstsc.EXE launched from uncommon browser or email parent process

Alerts when mstsc.exe is spawned by a browser or Outlook, suggesting potential RDP access using a local .rdp file.

Windows mstsc.exe launched with a local .rdp file from suspicious paths

Alerts on mstsc.exe executions that use a local .rdp file referenced from suspicious command-line paths.

Windows mstsc.exe launched with local .rdp file argument

Alerts on mstsc.exe executions that reference local .rdp files via the command line.