Q3 detection rule pack — persistence and execution

Eleven Sigma rules and three YARA signatures covering the persistence and execution techniques that showed up most in this quarter's casework, with measured false-positive budgets.

Security Artifacts

25 August 20261 min readUpdated 30 August 2026

ATT&CK: T1547.001 T1059.001 T1218.011 T1055
Filed under: sigma yara detection-engineering rule-pack

The rules in this pack came out of three months of casework, and every one of them has a measured false-positive budget attached — the number of alerts it produced over fourteen days on a 25-host lab domain with a production-shaped Sysmon configuration.

[!] members only

The rest of this teardown — the full timeline, the complete IOC list and the detection rule with its tuning notes — is for members. Sign in if you have an account, or start a 7-day trial. No card is charged and none is collected up front.