Sigma detection rules, expert-reviewed

Windows Process Creation: dotnet-dump.exe collect Flag

Flags dotnet-dump.exe executions using the collect parameter, which may indicate memory dumping of sensitive processes.

Windows: Detect csvde.exe Active Directory export to CSV

Flags csvde.exe executions on Windows that include -f, consistent with exporting Active Directory data for discovery.

Windows Registry Event for Potential Qakbot/IceID Persistence Key

Alerts on Windows registry events referencing a specific \\Software\\firm\\soft\\Name key suffix linked to Qakbot/IceID-like activity.

Windows Rundll32 Execution Masquerading as Image Files via Image Extensions

Flags rundll32.exe executions whose command line references image file extensions used for DLL masquerading.

Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Alerts on PowerShell using web request cmdlets to download an HTTP DLL to disk.

PowerShell GzipStream Decompression Attempts on Windows

Detects Windows PowerShell commands using GZipStream and ::Decompress to decompress encoded Gzip data.

Windows Wazuh Platform DLL Side-Loading via ImageLoad of libwazuhshared.dll

Alerts on suspicious loading of Wazuh platform DLLs in Windows image load telemetry, excluding common Program Files and Mingw64 patterns.

Windows Rcdll.dll DLL Sideloading via Image Load Path

Flags rcdll.dll loads from unexpected locations, excluding Visual Studio and Windows Kits directories.

Windows AMSI.DLL Image Load by Uncommon Process Paths

Alerts when Amsi.dll is loaded by processes outside common Windows binaries and directories.

Windows 7-Zip Extracts Password-Protected Archives via 7z/7za/7zr

Flags 7-Zip (7z/7za/7zr) command lines that include -p with x extraction and -o output, indicating password-protected archive extraction.

Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic

Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.

Windows Sysmon Configuration Update via Sysmon64 Command-Line

Flags execution of Sysmon binaries with '-c', indicating a Sysmon configuration update attempt.

Linux Package Removal via yum, apt, dpkg, or rpm Commands

Detects package uninstall activity on Linux via yum, apt/apt-get, dpkg, or rpm based on command-line removal flags.

Windows Process Execution Matches Griffon Malicious Command-Line Pattern

Alerts on Windows process command lines containing a temp staging path plus jscript execution indicators and a .txt target.

Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)

Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.