Sigma Rules
28 rules found
New Github Organization Member Added
Detects when a new member is added or invited to a github organization.
New Okta User Created
Detects new user account creation
System Shutdown/Reboot - Linux
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
System and Hardware Information Discovery
Detects system information discovery commands
File and Directory Discovery - Linux
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
File Deletion
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity
System Information Discovery
Detects system information discovery commands
System Network Discovery - Linux
Detects enumeration of local network configuration
File and Directory Discovery - MacOS
Detects usage of system utilities to discover files and directories
Local Groups Discovery - MacOs
Detects enumeration of local system groups
Network Sniffing - MacOs
Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Macos Remote System Discovery
Detects the enumeration of other remote systems.
System Network Discovery - macOS
Detects enumeration of local network configuration
System Network Connections Discovery - MacOs
Detects usage of system utilities to discover system network connections
System Shutdown/Reboot - MacOs
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Failed Code Integrity Checks
Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.
User Logoff Event
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
VSSAudit Security Event Source Registration
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Locked Workstation
Detects locked workstation session events that occur automatically after a standard period of inactivity.
Windows Update Error
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
Windows Defender Malware Detection History Deletion
Windows Defender logs when the history of detected infections is deleted.
New PowerShell Instance Created
Detects the execution of PowerShell via the creation of a named pipe starting with PSHost
PowerShell Decompress Commands
A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.
Suspicious High IntegrityLevel Conhost Legacy Option
ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
New Application in AppCompat
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Windows Spooler Service Suspicious Binary Load
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
Potential BOINC Software Execution (UC-Berkeley Signature)
Detects the use of software that is related to the University of California, Berkeley via metadata information. This indicates it may be related to BOINC software and can be used maliciously if unauthorized.
Suspicious Tasklist Discovery Command
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network