Sigma detection rules, expert-reviewed

SharpHound RPC Firewall Recon: Remote Mapping and Group Membership Enumeration

Alerts on RPC Firewall EventID 3 for SharpHound-style discovery RPC calls to interface UUID with OpNum 12.

SharpHound Account Recon via RPC Firewall Block (OpNum 2, Interface UUID)

Alerts on RPC Firewall EventID 3 with the Interface UUID and OpNum used by SharpHound for account discovery.

RPC Firewall Alerts for SASec Scheduled Task Discovery (SASec)

Identifies RPC Firewall alerts for SASec interface calls related to scheduled task discovery.

PowerShell Credential Discovery via Recursive File Search and Select-String

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.

Windows Sysmon Discovery Attempt via Findstr.exe Default Driver Altitude (385201)

Alerts on findstr/find.exe executions containing 385201, consistent with using Sysmon default driver altitude for discovery.

PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)

Flags PowerShell scripts that enumerate processes and filter results for security software by vendor/product keywords.

PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.

PowerShell Module: Get-SmbShare Used for SMB Share Discovery

Detects PowerShell module usage of Get-SmbShare to enumerate SMB shares across networked systems.

PowerShell module enumeration of AD principals via get-ADPrincipalGroupMembership

Flags PowerShell module usage of Get-ADPrincipalGroupMembership and Get-ADUser with -pr -f patterns indicative of AD discovery.

Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags

Flags AdFind.exe processes that look like Active Directory discovery via password policy and object enumeration options.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

PowerShell Local Group Discovery via Get-LocalGroup and Get-LocalGroupMember (Windows)

Identifies PowerShell commands enumerating local groups and their members, indicating potential local permission discovery.

Windows Process Discovery via tasklist Command Execution

Alerts on Windows executions of tasklist.exe used for running process discovery.

Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution

Flags Windows execution of Nmap/Zenmap (nmap.exe or zennmap.exe) used for remote service discovery.