Sigma detection rules, expert-reviewed

Webserver: OWASSRF exploitation attempt via OWA to PowerShell backend

Flags webserver POSTs returning 200 that request both /owa/mastermailbox and /powershell, consistent with OWASSRF exploitation attempts.

Detect OWASSRF Webserver Exploitation Pattern Targeting PowerShell Backend

Alerts on successful POST requests to OWA URLs containing PowerShell backend indicators and Exchange-like probe user agents.

Detects OWASSRF Proxy Exploitation Attempt via OWA to PowerShell Backend

Identifies proxy POSTs that return 200 and request both /owa/mastermailbox and /powershell, indicating potential OWASSRF exploitation.

Potential OWASSRF Exploitation via OWA Proxy Requests (HTTP 200) - Exchange

Alerts on 200-status proxy POSTs targeting OWA-to-PowerShell backend paths with encoded user info markers.

Windows Process Creation: Impersonate.exe HackTool Execution

Flags execution of impersonate.exe (Impersonate tool) on Windows using command-line subcommands or known hashes.

Linux: usermod used to add users to root or sudoers groups

Detects usermod commands that append a user to root or sudoers groups, indicating potential privilege escalation persistence.

Linux: New user created with UID=0 or GID=0/10/27 indicating privileged group access

Alerts on Linux user creation events that assign privileged UID/GID values like root, wheel, or sudo.

Windows Registry Set Detection of Suspicious Environment Variable Commands

Flags Windows registry environment variable registrations that include PowerShell and base64-encoded command fragments.

Windows Office Binary Execution with Renamed Image Path

Alerts when Office apps are executed under renamed or unexpected image paths, helping catch stealthy masquerading on Windows.

Windows SQLite CLI Querying Chromium Browser Profile Databases

Alerts when SQLite CLI is used to query Chromium-based browser profile databases containing logins, cookies, or history.

Windows DLL Sideloading via comctl32.dll in .local directories

Alerts on comctl32.dll loaded from System32 .local folders, consistent with Windows DLL sideloading.

Windows File Events: Suspicious .exe.local Path With comctl32.dll in System32

Detects System32 *.exe.local entries that reference comctl32.dll, consistent with DLL sideloading behavior.

Windows DLL Sideloading Indicator: JsSchHlp Loads JSESPR.dll from Untrusted Path

Alerts on unexpected loads of \JSESPR.dll, indicating possible DLL sideloading outside the Justsystem JsSchHlp directory.

Windows DLL Sideloading: ClassicExplorer32.dll Loaded from Unexpected Path

Alerts when ClassicExplorer32.dll is loaded from unexpected locations, suggesting possible DLL sideloading behavior.

AWS SES Identity Deleted via CloudTrail DeleteIdentity Event

Flags CloudTrail events showing an SES identity was deleted using the DeleteIdentity API.