Sigma detection rules, expert-reviewed

Windows HackTool Certify Execution via Certify.exe and common AD abuse arguments

Identifies Windows processes running Certify.exe with AD certificate abuse-oriented command line arguments.

Windows image_load Suspicious libvlc.dll DLL sideloading via non-VLC paths

Alerts when libvlc.dll is loaded from a non-default path, suggesting potential VLC DLL sideloading on Windows.

Windows: Unexpected Termination of Message Queuing (MSMQ) Service via SCM Event 7034

Flags Service Control Manager Event ID 7034 for unexpected termination of the Message Queuing (MSMQ) service.

Windows Service Control Manager: Termination of Security-Critical Services With Error

Alerts on error-terminated Windows security and infrastructure services from Service Control Manager event 7023.

Windows Service Terminated With Error (Service Control Manager Event 7023)

Alerts on Windows services terminated with an error as reported by the Service Control Manager (EventID 7023).

Windows: Detect Action1 agent deployment, command execution, and remote session startup

Finds Action1 agent deployments, script-launched command/PowerShell execution, and remote session starts on Windows.

Windows: Suspicious subprocesses launched by mqsvc.exe consistent with CVE-2023-21554 exploitation

Alerts when mqsvc.exe spawns common scripting/utility executables often used for unauthorized execution.

Windows: Renamed Visual Studio NodejsTools PressAnyKey.exe Execution

Flags Windows executions of renamed Microsoft.NodejsTools.PressAnyKey.exe to help spot LOLBIN-style abuse.

Linux Process Creation: Ruby -e Reverse Shell Socket Usage

Detects inline Ruby (-e) using rsocket/TCPSocket and shell keywords, which may indicate reverse-shell style behavior.

Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r

Alerts on Linux executions of php -r inline code that references fsockopen, consistent with outbound reverse-shell style socket creation.

Linux Perl Reverse Shell Execution via Perl -e and Socket/exec Patterns

Detects perl -e one-liners on Linux that include Perl Socket::INET reverse-shell code patterns and exec/connect logic.

Linux Netcat Execution with -e/-c Launching Common Shells

Alerts on Linux executions of nc/ncat using -e that reference common shells, indicating potential reverse-shell setup.

Linux Bash Launched in Interactive Mode (-i)

Alerts when /bash is executed with the interactive flag (-i) on Linux.

Windows: Logged-On User Password Change via ksetup.exe

Flags ksetup.exe executions with /ChangePassword that may indicate a logged-on user password change on Windows.

Windows Password Change via ksetup.exe /setcomputerpassword

Alerts on Windows ksetup.exe executions that set a computer password via /setcomputerpassword.