Sigma detection rules, expert-reviewed

OpenSSH Server (sshd) Listening on SSH Socket on Windows

Flags OpenSSH (sshd) events showing the SSH server has started listening on a socket.

Inveigh Execution via Process Creation (Windows)

Detects execution of Inveigh.exe on Windows with spoofing/sniffing command-line flags consistent with MITM behavior.

PowerShell: Suspicious Set-Service DACL/SecurityDescriptor Modification for Hidden Services

Flags PowerShell ScriptBlock activity using Set-Service with specific SDDL elements consistent with hiding services from tools like sc.exe.

Windows Inveigh HackTool Execution Artefacts via Inveigh File Indicators

Alert on Windows file creation or presence of Inveigh log, script, and binary artefacts identified by distinctive filename suffixes.

Windows MsiInstaller installs remote MSI from web URLs (EventID 1040/1042)

Flags Windows Installer MsiInstaller events that indicate downloading and installing an MSI from a URL.

Windows Alternate Data Stream Creation: Suspicious Zone.Identifier ADS Outside Browser Download

Flags suspicious creation of :Zone.Identifier ADS streams (ZoneTransfer/ZoneId=3) on file types outside typical browsers.

Windows: Suspicious Child Processes Spawned by Electron Apps

Flags suspicious command/scripting child processes launched by Electron apps such as Teams, Discord, Slack, and Edge.

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Alerts when onenote.exe spawns suspicious script or system execution child processes on Windows, consistent with malicious OneNote payload behavior.

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Alerts on suspicious .dll file creation by Office/cmd/scripting processes in AppData and OneDrive/Teams/Slack/VS Code directories.

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Alerts when Script Editor launches command-line tools or interpreters like curl, shell binaries, python, or perl.

Windows Process Execution: SafetyKatz HackTool (SafetyKatz.exe)

Alerts when a process running SafetyKatz.exe is created, using image path and embedded file metadata.

Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution

Alerts on Windows process launches of Seatbelt.exe with discovery group arguments and outputfile usage.

PowerShell Set-Acl targeting Windows folder paths on Windows

Flags PowerShell Set-Acl commands that modify ACLs for Windows folder paths, often using FullControl/Allow.

PowerShell Set-Acl Script Execution Changes File or Folder Permissions on Windows

Flags PowerShell commands using Set-Acl (-AclObject and -Path) to alter Windows file or folder permissions.

PowerShell Set-Service SecurityDescriptorSddl DACL Modification for Windows Services

Detects PowerShell Set-Service commands with SecurityDescriptorSddl SDDL patterns that modify Windows service DACLs.