Sigma detection rules, expert-reviewed

Windows: OneNote .one/.onepkg File Creation in Suspicious Locations

Flags creation of OneNote attachment files (.one/.onepkg) in temp/public-style paths on Windows.

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Detects rundll32 executions that reference DLLs stored in Alternate Data Streams via ADS-style paths.

Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact

Alerts on creation of PsExec key files in C:\Windows\PSEXEC-*.key, indicating remote execution activity.

Windows Process Creation: svchost DHCPServer RCE Exploitation Attempt

Alerts on svchost.exe running as Network Service with -k DHCPServer, suggesting a potential pre-auth Windows RCE attempt.

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Alerts on PowerShell module payloads containing commandlet/function names from known malicious exploitation and post-exploitation frameworks.

GitHub Audit: Outside Collaborator Membership and Permission Changes

Alerts on GitHub audit events involving outside collaborators being removed or permission changes on projects.

GitHub audit: New Actions secret created for org, environment, repo, or Codespaces

Triggers on GitHub audit events when an actor creates a new Actions secret for org, environment, Codespaces, or repo.

Detect CentOS Web Panel POST login reverse-shell RCE attempts (CVE-2022-44877)

Alert on POST requests to CentOS Web Panel login that contain command-execution and reverse-shell style query parameters.

Windows driverquery.exe Process Execution Detection

Alerts on Windows executions of driverquery.exe (drvqry.exe) used to enumerate installed drivers, with parent-process exclusions to reduce duplicates.

Windows: driverquery.exe Usage for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

Windows Successful SMB Logon (Event ID 4624 Logon Type 3) From Public IPs

Flags successful Windows SMB (LogonType 3) logons from non-private, non-local source IP addresses.

Windows RDP Successful Logon (4624 LogonType 10) from Public IP

Alerts on successful RDP (LogonType 10) from a non-private, non-local source IP in Windows Security Event 4624.

Okta Admin Role Assignment Created via iam.resourceset.bindings.add

Detects creation of new admin role assignments in Okta when an IAM resource set binding is added.

GitHub Audit Log: Delete Actions for Codespaces, Environments, Projects, and Repositories

Alerts on GitHub audit log deletion actions for Codespaces, environments, projects, and repositories.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.