Informational-severity Sigma rules

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

windows

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

linux · process_creation

Detects usage of system utilities to discover files and directories

macos · process_creation

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

linux · process_creation

Detects enumeration of local system groups

macos · process_creation

Detects locked workstation session events that occur automatically after a standard period of inactivity.

windows

Detects the enumeration of other remote systems.

macos · process_creation

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

macos · process_creation

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

windows · registry_set

Detects when a new member is added or invited to a github organization.

github

Detects new user account creation

okta

Detects the execution of PowerShell via the creation of a named pipe starting with PSHost

windows · pipe_created

Detects the use of software that is related to the University of California, Berkeley via metadata information. This indicates it may be related to BOINC software and can be used maliciously if unauthorized.

windows · process_creation

A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.

windows · ps_module

ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

windows · process_creation

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

windows · process_creation

Detects system information discovery commands

linux

Detects system information discovery commands

linux · process_creation

Detects usage of system utilities to discover system network connections

macos · process_creation

Detects enumeration of local network configuration

linux · process_creation

Detects enumeration of local network configuration

macos · process_creation

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

linux

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

macos · process_creation

Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

windows

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

windows

Windows Defender logs when the history of detected infections is deleted.

windows

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

windows · image_load

Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.

windows