Sigma detection rules, expert-reviewed

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.

Web server requests targeting WebLogic JNDI LDAP via JndiBindingHandle (CVE-2021-2109)

Alerts on GET requests with WebLogic JndiBindingHandle and an ldap:// payload targeting AdminServer.

Windows PowerShell Command Lines with WMI Process Creation and rundll32 Invocation

Flags Windows command lines where PowerShell/WMI is used to spawn rundll32 from c:\windows.

SolarWinds Orion Web API auth bypass probing via suspicious WebResource requests

Detects likely SolarWinds Orion API authentication bypass probing by matching suspicious WebResource/i18n endpoint query strings while filtering known valid requests.

Windows rundll32.exe Command-Line RunDLL or Control_RunDLL Execution

Alerts on rundll32.exe process launches whose command lines end with RunDLL/Control_RunDLL, indicative of DLL function loading.

Windows Process Creation Alerts for Suspicious Lazarus-Linked Command-Line Execution

Alerts on Windows process executions with command-line substrings consistent with behaviors described in Lazarus activity reports.

Detect SolarWinds SUPERNOVA Webshell URL Access on Webservers (logoimagehandler.ashx)

Identifies webserver traffic consistent with SUPERNOVA webshell access targeting logoimagehandler.ashx with a clazz query parameter.

Fortinet SSL VPN Exploitation Attempt via Path Traversal in Web Requests (CVE-2018-13379)

Alerts on HTTP requests matching a Fortinet SSL VPN traversal-style query indicative of CVE-2018-13379 exploitation.

LockerGoga Ransomware Indicators in Windows Process Command Line

Flags Windows processes with a specific LockerGoga-style command-line argument pattern.

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Identifies Windows Zerologon exploitation attempts tied to Kali-hosted activity and mimikatz-related keywords.

Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll Image Load

Alerts when iexplore.exe loads iertutil.dll from an Internet Explorer path, indicating possible DLL hijacking.

Windows WMI DLL Hijack via Network-placed wbemcomn.dll in System32\wbem

Alerts when System creates wbemcomn.dll in C:\Windows\System32\wbem\, consistent with WMI DLL hijack file staging.

Windows DCOM InternetExplorer.Application iertutil.dll DLL Hijack Suspicion

Alerts when System writes iertutil.dll in the DCOM InternetExplorer.Application path, consistent with potential DLL hijacking.

Windows PowerShell: Detect Suspicious Opsec Artifacts in Script Module Content

Identifies PowerShell module content containing frequent offensive payload string markers associated with poor operational security.

Windows Process Creation: Winnti Pipemon setup* Command-Line Parameters

Alerts on Windows processes launching Pipemon-style setup.exe command lines with specific -p or -x:n flags.