Sigma detection rules, expert-reviewed

Windows: Detect Action1 agent deployment, command execution, and remote session startup

Finds Action1 agent deployments, script-launched command/PowerShell execution, and remote session starts on Windows.

Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation

Alerts when mqsvc.exe spawns common scripting/utility executables often used for unauthorized execution.

Windows: Renamed Visual Studio NodejsTools PressAnyKey.exe Execution

Flags Windows executions of renamed Microsoft.NodejsTools.PressAnyKey.exe to help spot LOLBIN-style abuse.

Linux Process Creation: Ruby -e Reverse Shell Socket Usage

Detects inline Ruby (-e) using rsocket/TCPSocket and shell keywords, which may indicate reverse-shell style behavior.

Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r

Alerts on Linux executions of php -r inline code that references fsockopen, consistent with outbound reverse-shell style socket creation.

Linux Perl Reverse Shell Execution via Perl -e and Socket/exec Patterns

Detects perl -e one-liners on Linux that include Perl Socket::INET reverse-shell code patterns and exec/connect logic.

Linux netcat/ncat Execution with -e and Shell Invocation

Alerts on Linux executions of nc/ncat using -e that reference common shells, indicating potential reverse-shell setup.

Linux Bash Launched in Interactive Mode (-i)

Alerts when /bash is executed with the interactive flag (-i) on Linux.

Windows: Logged-On User Password Change via ksetup.exe

Flags ksetup.exe executions with /ChangePassword that may indicate a logged-on user password change on Windows.

Windows Password Change via ksetup.exe /setcomputerpassword

Alerts on Windows ksetup.exe executions that set a computer password via /setcomputerpassword.

Suspicious Child Processes Spawned by Browsers on macOS

Alerts on browser-launched child processes on macOS where the child is a shell or scripting/utility binary, excluding known benign browser scripts.

Windows SMBClient Connectivity: Failed Outbound SMB Connection Attempts to Internet-Facing Servers

Identifies Windows SMB client failures to connect to external SMB servers by correlating specific SMB connectivity event IDs with non-private remote addresses.

Windows Registry Changes for Outlook Task/Note Reminder Trigger

Flags Windows registry writes under Outlook task/note keys consistent with an Outlook reminder being triggered.

Windows: Rorschach execution indicator via critical command-line pattern

Windows process creation events with certain system utilities and a "11111111" command-line marker are flagged as ransomware execution activity.

macOS: Process execution of osacompile by applet/osascript child processes

Flags macOS applet or osascript processes launching command lines that contain osacompile.