diff --git a/packs/linux/advanced/pack.yml b/packs/linux/advanced/pack.yml
index c5b9457..b5cd4f5 100644
--- a/packs/linux/advanced/pack.yml
+++ b/packs/linux/advanced/pack.yml
@@ -21,9 +21,19 @@ attack_coverage:
   - T1059.004
   - T1036
   - T1105
+  - T1071
+  - T1070.003
+  - T1070.002
+  - T1548.001
+  - T1547
+  - T1505.003
+  - T1027
+  - T1562.001
+  - T1219
 telemetry_requirements:
   - file_event
   - process_creation
+  - network_connection
   - file_scan
 test_status: none
 sources:
@@ -37,3 +47,13 @@ rules:
           - 5f607182-93a4-45b6-9fc7-4a5b6c7d8e95   # Shell Profile / RC File Persistence (sigma)
           - 60718293-a4b5-46c7-8fd8-5b6c7d8e9fa6   # Execution from World-Writable / Temporary Directory (sigma)
           - 94fb53c7-debd-4287-99e4-6eb0ba923731   # Linux Download and Execute Piped to Shell (sigma)
+          - d0c6216e-881c-408f-8e72-0a466522306b   # Outbound Network Connection from Shell Binary (sigma)
+          - 6df6fcdc-e5e5-413b-aabe-ec3d51d6bfeb   # Shell History File Tampering (sigma)
+          - 6b124b53-1d4b-48a2-86b7-4df9bf43de61   # System Log Clearing (journal and /var/log) (sigma)
+          - 7a34ffc3-adbc-4d9d-94a4-4bd33ac05cc3   # SUID/SGID Bit Added via chmod (sigma)
+          - 1bb5e9e4-f17e-476e-8e77-aaa1858f12f7   # udev Rules Persistence (sigma)
+          - e96a9b85-26f6-4251-a26b-361d4b6761ef   # Webshell Written by Web-Server Process (sigma)
+          - d24c4943-3e22-481f-99ee-ca631b8a77af   # Base64-Decode Piped to Shell (sigma)
+          - 0cb59840-b420-4332-b7d1-2c3d4343901f   # Security Service Stop (auditd / AppArmor / SELinux / EDR) (sigma)
+        yara:
+          - yara-lnx-sliver-implant   # Sliver C2 implant artifacts in Linux ELF (yara)
diff --git a/packs/linux/essential/pack.yml b/packs/linux/essential/pack.yml
index 0cbc94a..0327b93 100644
--- a/packs/linux/essential/pack.yml
+++ b/packs/linux/essential/pack.yml
@@ -19,6 +19,10 @@ attack_coverage:
   - T1505.003
   - T1562.001
   - T1496
+  - T1071
+  - T1547.006
+  - T1014
+  - T1136.001
 telemetry_requirements:
   - process_creation
   - file_event
@@ -36,7 +40,11 @@ rules:
           - a3c5c821-004a-4e52-8684-0f7f9ea0404c   # Linux Reverse Shell via /dev/tcp (sigma)
           - 8fd4d1d9-38cf-4704-8009-00e41a009c98   # Linux Web Server Spawning Interactive Shell (sigma)
           - 9ac8732e-1818-4cda-89ac-01ca08a7b836   # SSH Daemon Configuration Tampering (sigma)
+          - 1adaaaca-bfcf-46fe-9bd1-4b475d7bc827   # Netcat or Socat Reverse Shell Execution (sigma)
+          - 3f32d825-006a-45e9-b5a9-6e7edeeff13c   # Kernel Module Load from Suspicious Path (sigma)
+          - 66fd4673-d86b-41d1-ba33-60d7c66dc962   # Backdoor Account Creation (Duplicate UID 0) (sigma)
         yara:
           - yara-lnx-xmrig-coinminer                # XMRig / coinminer strings in Linux ELF binaries (yara)
+          - yara-lnx-msfvenom-stager   # Metasploit / Mettle stager markers in ELF binaries (yara)
         ioc:
           - ioc-eicar-test                         # EICAR safe end-to-end IOC test set (ioc)                         # EICAR safe end-to-end IOC test set (ioc)                         # EICAR safe end-to-end IOC test set (ioc)
diff --git a/packs/macos/advanced/pack.yml b/packs/macos/advanced/pack.yml
index 35d6214..63a4f17 100644
--- a/packs/macos/advanced/pack.yml
+++ b/packs/macos/advanced/pack.yml
@@ -24,6 +24,8 @@ attack_coverage:
   - T1036
   - T1136.001
   - T1098
+  - T1098.004
+  - T1070.003
 telemetry_requirements:
   - process_creation
   - file_event
@@ -38,3 +40,6 @@ rules:
           - 3e506273-8f91-42a4-8eb4-5f6071823405   # Shell Download-and-Execute Pipe Cradle (sigma)
           - 2f617384-9012-43b5-9fc5-60718293a416   # Local Admin Account Created via Directory Services (sigma)
           - 1a728495-a123-44c6-8ad6-718293a4b527   # Execution from World-Writable or Temporary Directory (sigma)
+          - c92540cf-466d-4959-ab25-1c456bedf9d5   # SSH authorized_keys Created or Replaced (macOS) (sigma)
+          - 578195d3-de1a-4c46-84c8-b246a060474c   # launchctl Load from User-Writable Path (sigma)
+          - ffd3b3b3-9fd4-4fd2-9988-fe837e062181   # Shell History File Tampering (macOS) (sigma)
diff --git a/packs/macos/essential/pack.yml b/packs/macos/essential/pack.yml
index 31f9214..2030776 100644
--- a/packs/macos/essential/pack.yml
+++ b/packs/macos/essential/pack.yml
@@ -23,6 +23,9 @@ attack_coverage:
   - T1562.001
   - T1105
   - T1496
+  - T1005
+  - T1548
+  - T1555.003
 telemetry_requirements:
   - process_creation
   - file_scan
@@ -37,6 +40,8 @@ rules:
           - 6b2d3f40-5c6e-4f71-9b81-2c3d4e5f6012   # osascript Credential Prompt or Suspicious Admin Shell (sigma)
           - 5c3e4051-6d7f-4082-8c92-3d4e5f601203   # Gatekeeper or Quarantine Protection Disabled (sigma)
           - be06a6b0-fa9f-4df4-9d4a-9f8794037508   # macOS Reverse Shell via /dev/tcp (sigma)
+          - 829cee70-a60f-4e8a-8b2f-38e1fff83e61   # TCC Database Access (sigma)
+          - db01bf97-33ca-4ce4-8ee7-7bbd4b4844f8   # Browser Credential Store Access (sigma)
         yara:
           - yara-macos-coinminer-strings           # Cryptominer Mach-O strings (yara)
         ioc:
diff --git a/packs/windows/advanced/pack.yml b/packs/windows/advanced/pack.yml
index de16f60..cc214fe 100644
--- a/packs/windows/advanced/pack.yml
+++ b/packs/windows/advanced/pack.yml
@@ -22,12 +22,24 @@ attack_coverage:
   - T1543.003
   - T1053.005
   - T1047
+  - T1547.004
+  - T1562.001
+  - T1059.001
+  - T1090.001
+  - T1197
+  - T1071
+  - T1218
+  - T1219
 telemetry_requirements:
   - process_creation
   - registry_event
   - task_creation
   - ps_script
   - service_creation
+  - image_load
+  - network_connection
+  - file_event
+  - file_scan
 test_status: manual
 sources:
     manual:
@@ -43,3 +55,14 @@ rules:
           - d4e5f6a7-0123-4345-9d6e-7f8a9b012a13   # Suspicious Service Binary Path
           - 4a596825-4674-4db3-b360-842435edf11a   # Scheduled Task Creation via Schtasks
           - 2a3c3182-80b8-42d4-bd39-83c55582ef70   # WMI Process Execution via WMIC
+          - 52b94494-756b-40d7-af01-8d0c7d54a6cc   # Winlogon Helper DLL or Shell Modification (sigma)
+          - 43c59081-d5ec-4153-9e26-04e66e07461a   # Security Service Stop or Disable via sc or net (sigma)
+          - 31ddbaff-1a32-4eb6-b7ce-647b59aeb901   # AMSI Bypass Pattern in PowerShell ScriptBlock (sigma)
+          - 86c19f1a-add5-4553-9c24-f76e7fe3da9d   # Unmanaged PowerShell via Automation DLL in Foreign Host (sigma)
+          - 6c46cc68-2e66-4834-b058-0a2cfd115409   # Netsh Port-Proxy Tunnel Configuration (sigma)
+          - d97177dd-c74f-465e-96c1-194cc1dd681d   # BITS Job Download via bitsadmin (sigma)
+          - 59bbd501-1c61-45c9-940d-9465cabd36c4   # File Dropped in Startup Folder (sigma)
+          - 717396f6-aff0-49b0-b8f3-53568e276d5c   # Outbound Connection from Script or LOLBin Host (sigma)
+        yara:
+          - yara-win-sliver-implant   # Sliver C2 implant artifacts in Windows PE (yara)
+          - yara-win-cobaltstrike-beacon   # Cobalt Strike beacon artifacts in Windows PE (yara)
diff --git a/packs/windows/essential/pack.yml b/packs/windows/essential/pack.yml
index d67481c..c23620b 100644
--- a/packs/windows/essential/pack.yml
+++ b/packs/windows/essential/pack.yml
@@ -26,10 +26,16 @@ attack_coverage:
   - T1548.002
   - T1053.005
   - T1105
+  - T1546.003
+  - T1070
+  - T1546.008
+  - T1546.012
+  - T1496
 telemetry_requirements:
   - process_creation
   - registry_event
   - task_creation
+  - wmi_event
   - file_scan
 test_status: mixed
 sources:
@@ -52,7 +58,14 @@ rules:
           - a3c7e9b4-2f81-4d56-8c0a-6b2d1f4e9c22   # Active Directory Database (NTDS.dit) Extraction (sigma)
           - b4d8f0c5-3a92-4e67-9d1b-7c3e2f5a0d23   # WDigest Cleartext Credential Caching Enabled (sigma)
           - 3a1cdc64-a2a1-444b-a04b-32a3f1d09a99   # Scheduled Task Created With Suspicious Action (sigma)
+          - d6adbfee-548b-4def-9e49-8e6940251957   # WMI Event Subscription Persistence (sigma)
+          - e86de5fe-3908-4a95-b4e8-930a93bf4555   # Boot Recovery Tampering via bcdedit or wbadmin (sigma)
+          - 596b49d3-561e-49d7-9538-f3115c1c8cfd   # USN Journal Deletion via fsutil (sigma)
+          - 04d66f93-97ae-4674-96a8-1bb524a1da60   # LSASS Memory Dump via Procdump (sigma)
+          - cda4a133-fe67-4aa6-815d-f8c69ff16828   # IFEO Debugger or SilentProcessExit Hijack (sigma)
         yara:
           - yara-win-mimikatz-strings              # Mimikatz credential-dumping strings (yara)
+          - yara-win-xmrig-coinminer   # XMRig / coinminer strings in Windows PE binaries (yara)
+          - yara-win-msfvenom-stager   # Metasploit / Meterpreter stager markers in Windows PE (yara)
         ioc:
           - ioc-eicar-test                         # EICAR safe end-to-end IOC test set (ioc)                         # EICAR safe end-to-end IOC test set (ioc)                         # EICAR safe end-to-end IOC test set (ioc)
diff --git a/packs/windows/hunting/pack.yml b/packs/windows/hunting/pack.yml
index 330e443..2787585 100644
--- a/packs/windows/hunting/pack.yml
+++ b/packs/windows/hunting/pack.yml
@@ -16,8 +16,13 @@ extends:
   - windows-advanced
 attack_coverage:
   - T1105
+  - T1574.002
+  - T1033
+  - T1482
+  - T1069.002
 telemetry_requirements:
   - process_creation
+  - image_load
 test_status: none
 sources:
     manual:
@@ -27,3 +32,5 @@ rules:
     has:
         sigma:
           - 3e2d1c0b-5a4f-4938-8271-6a5b4c3d2e10   # Certutil Used to Download Remote Content (Hunting)
+          - 3248cbd6-6c77-4b5c-ab44-655e7fd75667   # Unsigned DLL Loaded from User-Writable Path (Hunting)
+          - 4aae4b03-4807-428a-ac89-5c5f3cda65e4   # Reconnaissance Command Burst (Hunting)
diff --git a/rules/sigma/linux/file_event_lnx_history_tamper.yml b/rules/sigma/linux/file_event_lnx_history_tamper.yml
new file mode 100644
index 0000000..d5ef416
--- /dev/null
+++ b/rules/sigma/linux/file_event_lnx_history_tamper.yml
@@ -0,0 +1,42 @@
+title: Shell History File Tampering
+id: 6df6fcdc-e5e5-413b-aabe-ec3d51d6bfeb
+status: experimental
+description: >
+  Detects deletion or replacement of a shell history file (.bash_history,
+  .zsh_history and friends), an almost-universal attacker hygiene step and a
+  cheap post-compromise tripwire.
+  Note: `history -c` and `unset HISTFILE` are shell builtins that never produce a
+  process event, which is exactly why this is a file rule. Rustinel's Linux file
+  telemetry observes creation and rename, so this catches a history file being
+  replaced or rewritten rather than an in-place truncate.
+references:
+  - https://attack.mitre.org/techniques/T1070/003/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1070.003
+logsource:
+  category: file_event
+  product: linux
+detection:
+  selection:
+    TargetFilename|endswith:
+      - '.bash_history'
+      - '.zsh_history'
+      - '.sh_history'
+      - '.ash_history'
+      - '.history'
+  condition: selection
+falsepositives:
+  - Users rotating dotfiles or logrotate-style cleanup of history files.
+level: medium
+rustinel:
+  telemetry:
+    - file_event
+  expected_false_positive_level: medium
+  test_status: manual
+  test_reason: >
+    Targets history-file delete/replace events, which the Linux atomic harness
+    does not yet reliably reproduce; validated manually with Atomic Red Team
+    T1070.003.
diff --git a/rules/sigma/linux/file_event_lnx_udev_persistence.yml b/rules/sigma/linux/file_event_lnx_udev_persistence.yml
new file mode 100644
index 0000000..1959fda
--- /dev/null
+++ b/rules/sigma/linux/file_event_lnx_udev_persistence.yml
@@ -0,0 +1,44 @@
+title: udev Rules Persistence
+id: 1bb5e9e4-f17e-476e-8e77-aaa1858f12f7
+status: experimental
+description: >
+  Detects creation or modification of a udev rules file, a persistence mechanism
+  that can run an attacker binary on device events. udev is the notable gap in
+  Linux persistence coverage (cron, systemd, ld.so.preload, ssh keys and shell
+  profiles are already covered) and is actively used by recent Linux malware such
+  as sedexp.
+references:
+  - https://attack.mitre.org/techniques/T1547/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.privilege-escalation
+  - attack.t1547
+logsource:
+  category: file_event
+  product: linux
+detection:
+  selection:
+    TargetFilename|startswith:
+      - '/etc/udev/rules.d/'
+      - '/lib/udev/rules.d/'
+      - '/usr/lib/udev/rules.d/'
+  filter_pkg:
+    Image|endswith:
+      - '/dpkg'
+      - '/rpm'
+      - '/dnf'
+      - '/apt'
+      - '/apt-get'
+      - '/yum'
+  condition: selection and not filter_pkg
+falsepositives:
+  - Driver and package installs write udev rules; the package-manager image filter
+    handles the bulk.
+level: medium
+rustinel:
+  telemetry:
+    - file_event
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/linux/file_event_lnx_webshell_write.yml b/rules/sigma/linux/file_event_lnx_webshell_write.yml
new file mode 100644
index 0000000..78e0c30
--- /dev/null
+++ b/rules/sigma/linux/file_event_lnx_webshell_write.yml
@@ -0,0 +1,47 @@
+title: Webshell Written by Web-Server Process
+id: e96a9b85-26f6-4251-a26b-361d4b6761ef
+status: experimental
+description: >
+  Detects a web-server or application-server process (nginx, apache, httpd,
+  php-fpm, php, tomcat, java) writing a server-side script file (.php, .jsp, .war
+  and friends). Webshells remain the number-one Linux initial-access persistence
+  after an exploited web application; this is drop-time detection complementing
+  the use-time "web server spawns shell" rule.
+references:
+  - https://attack.mitre.org/techniques/T1505/003/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.t1505.003
+logsource:
+  category: file_event
+  product: linux
+detection:
+  selection:
+    Image|endswith:
+      - '/nginx'
+      - '/apache2'
+      - '/httpd'
+      - '/php-fpm'
+      - '/php'
+      - '/java'
+    TargetFilename|endswith:
+      - '.php'
+      - '.php5'
+      - '.phtml'
+      - '.jsp'
+      - '.jspx'
+      - '.war'
+      - '.asp'
+      - '.aspx'
+  condition: selection
+falsepositives:
+  - CMS plugin installs and cache writers (WordPress); document webroot cache-path
+    filters per environment.
+level: high
+rustinel:
+  telemetry:
+    - file_event
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/linux/net_connection_lnx_shell_outbound.yml b/rules/sigma/linux/net_connection_lnx_shell_outbound.yml
new file mode 100644
index 0000000..6d9af86
--- /dev/null
+++ b/rules/sigma/linux/net_connection_lnx_shell_outbound.yml
@@ -0,0 +1,52 @@
+title: Outbound Network Connection from Shell Binary
+id: d0c6216e-881c-408f-8e72-0a466522306b
+status: experimental
+description: >
+  Detects a public-internet outbound connection whose owning process is a shell
+  binary (bash, sh, dash, zsh). This is the enrichment-race safety net: a reverse
+  shell whose /proc/<pid>/cmdline read loses the race is invisible to the
+  command-line reverse-shell rules, but its socket is not. Add legitimate public
+  endpoints to the private-network filter as tuning.
+references:
+  - https://attack.mitre.org/techniques/T1059/004/
+  - https://attack.mitre.org/techniques/T1071/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.command-and-control
+  - attack.execution
+  - attack.t1059.004
+  - attack.t1071
+logsource:
+  category: network_connection
+  product: linux
+detection:
+  selection:
+    Image|endswith:
+      - '/bash'
+      - '/sh'
+      - '/dash'
+      - '/zsh'
+      - '/ksh'
+  filter_private:
+    DestinationIp|cidr:
+      - '10.0.0.0/8'
+      - '172.16.0.0/12'
+      - '192.168.0.0/16'
+      - '127.0.0.0/8'
+      - '169.254.0.0/16'
+      - '::1/128'
+      - 'fe80::/10'
+  condition: selection and not filter_private
+falsepositives:
+  - Provisioning scripts that use /dev/tcp health checks against public
+    endpoints; the CIDR filter is the tuning surface.
+level: medium
+rustinel:
+  telemetry:
+    - network_connection
+  expected_false_positive_level: medium
+  test_status: manual
+  test_reason: >
+    The network_connection channel is not yet exercised by the atomic harness;
+    validated manually with a /dev/tcp connection from a shell to a lab public IP.
diff --git a/rules/sigma/linux/proc_creation_lnx_backdoor_account.yml b/rules/sigma/linux/proc_creation_lnx_backdoor_account.yml
new file mode 100644
index 0000000..a41bbdd
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_backdoor_account.yml
@@ -0,0 +1,39 @@
+title: Backdoor Account Creation (Duplicate UID 0)
+id: 66fd4673-d86b-41d1-ba33-60d7c66dc962
+status: experimental
+description: >
+  Detects useradd or usermod creating or modifying an account with UID 0,
+  including the --non-unique flag that permits a second root-equivalent account.
+  Nobody legitimately creates a duplicate UID-0 user; this is classic persistence
+  after webserver or SSH compromise and the Linux parity for the macOS local-admin
+  rule.
+references:
+  - https://attack.mitre.org/techniques/T1136/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.t1136.001
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection_tool:
+    Image|endswith:
+      - '/useradd'
+      - '/usermod'
+  selection_uid0:
+    CommandLine|contains:
+      - '-u 0'
+      - '--uid 0'
+      - '-o '
+      - '--non-unique'
+  condition: selection_tool and selection_uid0
+falsepositives:
+  - None expected; investigate any duplicate or manual UID-0 account creation.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/linux/proc_creation_lnx_base64_pipe_shell.yml b/rules/sigma/linux/proc_creation_lnx_base64_pipe_shell.yml
new file mode 100644
index 0000000..b787b35
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_base64_pipe_shell.yml
@@ -0,0 +1,44 @@
+title: Base64-Decode Piped to Shell
+id: d24c4943-3e22-481f-99ee-ca631b8a77af
+status: experimental
+description: >
+  Detects a command line that base64-decodes content and pipes the result
+  straight into a shell, the standard obfuscation wrapper of cryptominer droppers
+  and botnet installers (Kinsing, TeamTNT lineage). Complements the
+  download-pipe-shell rule.
+references:
+  - https://attack.mitre.org/techniques/T1027/
+  - https://attack.mitre.org/techniques/T1059/004/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.execution
+  - attack.t1027
+  - attack.t1059.004
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection_b64:
+    CommandLine|contains: 'base64'
+  selection_decode:
+    CommandLine|contains:
+      - ' -d '
+      - ' --decode'
+      - ' -d|'
+  selection_pipe:
+    CommandLine|contains:
+      - '| sh'
+      - '|sh'
+      - '| bash'
+      - '|bash'
+  condition: selection_b64 and selection_decode and selection_pipe
+falsepositives:
+  - CI systems occasionally decode and run build steps this way.
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/linux/proc_creation_lnx_chmod_suid.yml b/rules/sigma/linux/proc_creation_lnx_chmod_suid.yml
new file mode 100644
index 0000000..db63e10
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_chmod_suid.yml
@@ -0,0 +1,42 @@
+title: SUID/SGID Bit Added via chmod
+id: 7a34ffc3-adbc-4d9d-94a4-4bd33ac05cc3
+status: experimental
+description: >
+  Detects chmod setting the setuid or setgid bit, a standard privilege-escalation
+  persistence step after initial access (for example chmod u+s /bin/bash to keep
+  a root-capable shell).
+references:
+  - https://attack.mitre.org/techniques/T1548/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.privilege-escalation
+  - attack.persistence
+  - attack.t1548.001
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection:
+    Image|endswith: '/chmod'
+    CommandLine|contains:
+      - 'u+s'
+      - 'g+s'
+      - '4755'
+      - '4777'
+      - '6755'
+      - '2755'
+  filter_pkg:
+    ParentImage|endswith:
+      - '/dpkg'
+      - '/rpm'
+  condition: selection and not filter_pkg
+falsepositives:
+  - Package post-install scripts occasionally set setuid bits; the package-manager
+    parent filter handles the bulk (best-effort parent field on Linux).
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/linux/proc_creation_lnx_kmod_load_susp_path.yml b/rules/sigma/linux/proc_creation_lnx_kmod_load_susp_path.yml
new file mode 100644
index 0000000..68a77ad
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_kmod_load_susp_path.yml
@@ -0,0 +1,40 @@
+title: Kernel Module Load from Suspicious Path
+id: 3f32d825-006a-45e9-b5a9-6e7edeeff13c
+status: experimental
+description: >
+  Detects insmod or modprobe loading a kernel module from a world-writable or
+  user-owned path (/tmp, /dev/shm, /var/tmp, /home). This is the highest-impact
+  Linux persistence — rootkit installation (Diamorphine descendants, cryptomining
+  rootkits) — with a cheap, low-false-positive signal on servers.
+references:
+  - https://attack.mitre.org/techniques/T1547/006/
+  - https://attack.mitre.org/techniques/T1014/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.defense-evasion
+  - attack.t1547.006
+  - attack.t1014
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection:
+    Image|endswith:
+      - '/insmod'
+      - '/modprobe'
+    CommandLine|contains:
+      - '/tmp/'
+      - '/dev/shm/'
+      - '/var/tmp/'
+      - '/home/'
+  condition: selection
+falsepositives:
+  - Kernel developers building modules on workstations; near zero on servers.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/linux/proc_creation_lnx_log_clear.yml b/rules/sigma/linux/proc_creation_lnx_log_clear.yml
new file mode 100644
index 0000000..a96a943
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_log_clear.yml
@@ -0,0 +1,36 @@
+title: System Log Clearing (journal and /var/log)
+id: 6b124b53-1d4b-48a2-86b7-4df9bf43de61
+status: experimental
+description: >
+  Detects clearing of system logs — vacuuming the systemd journal, or removing /
+  truncating / shredding files under /var/log. A standard step in cryptominer and
+  botnet installs to erase evidence of the intrusion.
+references:
+  - https://attack.mitre.org/techniques/T1070/002/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1070.002
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection_journal:
+    Image|endswith: '/journalctl'
+    CommandLine|contains: '--vacuum'
+  selection_varlog:
+    Image|endswith:
+      - '/rm'
+      - '/truncate'
+      - '/shred'
+    CommandLine|contains: '/var/log'
+  condition: selection_journal or selection_varlog
+falsepositives:
+  - Disk-space cleanup jobs that vacuum journals; filter known cron parent images.
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/linux/proc_creation_lnx_nc_exec_reverse_shell.yml b/rules/sigma/linux/proc_creation_lnx_nc_exec_reverse_shell.yml
new file mode 100644
index 0000000..20eda4a
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_nc_exec_reverse_shell.yml
@@ -0,0 +1,53 @@
+title: Netcat or Socat Reverse Shell Execution
+id: 1adaaaca-bfcf-46fe-9bd1-4b475d7bc827
+status: experimental
+description: >
+  Detects netcat or socat invoked with an execute flag, the classic pattern for
+  a reverse or bind shell (nc -e / --exec, socat EXEC: / SYSTEM:). Together with
+  the existing /dev/tcp rule this closes the two dominant Linux reverse-shell
+  primitives after initial access.
+  Note: on Linux CommandLine is best-effort /proc enrichment; the execute-flag
+  selections below require it, so a very short-lived nc/socat may instead be
+  caught only by its network-channel counterpart rule.
+references:
+  - https://attack.mitre.org/techniques/T1059/004/
+  - https://attack.mitre.org/techniques/T1071/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.execution
+  - attack.command-and-control
+  - attack.t1059.004
+  - attack.t1071
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection_nc:
+    Image|endswith:
+      - '/nc'
+      - '/ncat'
+      - '/netcat'
+    CommandLine|contains:
+      - ' -e '
+      - ' -c '
+      - '--exec'
+      - '--sh-exec'
+      - '--lua-exec'
+  selection_socat:
+    Image|endswith: '/socat'
+    CommandLine|contains:
+      - 'exec:'
+      - 'EXEC:'
+      - 'system:'
+      - 'SYSTEM:'
+  condition: selection_nc or selection_socat
+falsepositives:
+  - Rare container entrypoints that use socat exec; add a parent-image filter if
+    needed.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/linux/proc_creation_lnx_stop_security_services.yml b/rules/sigma/linux/proc_creation_lnx_stop_security_services.yml
new file mode 100644
index 0000000..43e43db
--- /dev/null
+++ b/rules/sigma/linux/proc_creation_lnx_stop_security_services.yml
@@ -0,0 +1,50 @@
+title: Security Service Stop (auditd / AppArmor / SELinux / EDR)
+id: 0cb59840-b420-4332-b7d1-2c3d4343901f
+status: experimental
+description: >
+  Detects stopping, disabling or masking of a Linux security service via
+  systemctl (auditd, apparmor, and common EDR agents), or disabling SELinux
+  enforcement via setenforce 0. This is the first move of TeamTNT-style cloud and
+  cryptomining intrusions. The service list is the tuning surface, mirroring the
+  Windows security-service-stop rule.
+references:
+  - https://attack.mitre.org/techniques/T1562/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1562.001
+logsource:
+  category: process_creation
+  product: linux
+detection:
+  selection_systemctl:
+    Image|endswith: '/systemctl'
+    CommandLine|contains:
+      - 'stop'
+      - 'disable'
+      - 'mask'
+  systemctl_service:
+    CommandLine|contains:
+      - 'auditd'
+      - 'apparmor'
+      - 'falcon-sensor'
+      - 'falcon'
+      - 'mdatp'
+      - 'sysmon'
+      - 'osqueryd'
+      - 'wazuh'
+  selection_setenforce:
+    Image|endswith: '/setenforce'
+    CommandLine|contains:
+      - ' 0'
+      - 'Permissive'
+  condition: (selection_systemctl and systemctl_service) or selection_setenforce
+falsepositives:
+  - Administrator maintenance windows; the service list is the tuning surface.
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/macos/file_event_macos_history_tamper.yml b/rules/sigma/macos/file_event_macos_history_tamper.yml
new file mode 100644
index 0000000..2ef5854
--- /dev/null
+++ b/rules/sigma/macos/file_event_macos_history_tamper.yml
@@ -0,0 +1,32 @@
+title: Shell History File Tampering (macOS)
+id: ffd3b3b3-9fd4-4fd2-9988-fe837e062181
+status: experimental
+description: >
+  Detects deletion or replacement of a shell history file on macOS (.zsh_history
+  is the primary target on modern macOS, .bash_history on older setups). macOS
+  port of the Linux history-tampering rule; a cheap post-compromise tripwire.
+references:
+  - https://attack.mitre.org/techniques/T1070/003/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1070.003
+logsource:
+  category: file_event
+  product: macos
+detection:
+  selection:
+    TargetFilename|endswith:
+      - '.zsh_history'
+      - '.bash_history'
+      - '.sh_history'
+  condition: selection
+falsepositives:
+  - Users rotating dotfiles or shell-history cleanup.
+level: medium
+rustinel:
+  telemetry:
+    - file_event
+  expected_false_positive_level: medium
+  test_status: none
diff --git a/rules/sigma/macos/file_event_macos_ssh_authorized_keys.yml b/rules/sigma/macos/file_event_macos_ssh_authorized_keys.yml
new file mode 100644
index 0000000..da8351c
--- /dev/null
+++ b/rules/sigma/macos/file_event_macos_ssh_authorized_keys.yml
@@ -0,0 +1,32 @@
+title: SSH authorized_keys Created or Replaced (macOS)
+id: c92540cf-466d-4959-ab25-1c456bedf9d5
+status: experimental
+description: >
+  Detects creation or replacement of an SSH authorized_keys file on macOS, a
+  platform-agnostic persistence and remote-access technique that lets an attacker
+  log in with their own key. macOS port of the Linux authorized_keys rule.
+references:
+  - https://attack.mitre.org/techniques/T1098/004/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.lateral-movement
+  - attack.t1098.004
+logsource:
+  category: file_event
+  product: macos
+detection:
+  selection:
+    TargetFilename|endswith:
+      - '/authorized_keys'
+      - '/authorized_keys2'
+  condition: selection
+falsepositives:
+  - Legitimate key provisioning via ssh-copy-id or configuration management.
+level: high
+rustinel:
+  telemetry:
+    - file_event
+  expected_false_positive_level: low
+  test_status: none
diff --git a/rules/sigma/macos/proc_creation_macos_browser_credential_theft.yml b/rules/sigma/macos/proc_creation_macos_browser_credential_theft.yml
new file mode 100644
index 0000000..d5b02b9
--- /dev/null
+++ b/rules/sigma/macos/proc_creation_macos_browser_credential_theft.yml
@@ -0,0 +1,44 @@
+title: Browser Credential Store Access
+id: db01bf97-33ca-4ce4-8ee7-7bbd4b4844f8
+status: experimental
+description: >
+  Detects a process reading or copying a browser credential, cookie or wallet
+  store (Chrome/Chromium Login Data and Cookies, Firefox logins.json and key4.db,
+  and browser-extension wallet storage). This is the core of the AMOS / Poseidon
+  stealer playbook; together with TCC access and the keychain-dump rule it covers
+  the three data targets of the current macOS stealer wave.
+references:
+  - https://attack.mitre.org/techniques/T1555/003/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.credential-access
+  - attack.t1555.003
+logsource:
+  category: process_creation
+  product: macos
+detection:
+  selection_tool:
+    Image|endswith:
+      - '/sqlite3'
+      - '/cp'
+      - '/ditto'
+      - '/rsync'
+  selection_target:
+    CommandLine|contains:
+      - '/Login Data'
+      - 'Cookies.binarycookies'
+      - '/Library/Cookies'
+      - '/logins.json'
+      - '/key4.db'
+      - '/Local Extension Settings/'
+  condition: selection_tool and selection_target
+falsepositives:
+  - Backup tools copying whole browser profiles; filter known backup images. The
+    specific-file targeting keeps direct hits high-signal.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: none
diff --git a/rules/sigma/macos/proc_creation_macos_launchctl_susp_load.yml b/rules/sigma/macos/proc_creation_macos_launchctl_susp_load.yml
new file mode 100644
index 0000000..f57b005
--- /dev/null
+++ b/rules/sigma/macos/proc_creation_macos_launchctl_susp_load.yml
@@ -0,0 +1,42 @@
+title: launchctl Load from User-Writable Path
+id: 578195d3-de1a-4c46-84c8-b246a060474c
+status: experimental
+description: >
+  Detects launchctl loading or bootstrapping a launch item from a world-writable
+  or temporary path (/tmp, /private/tmp, /Users/Shared, /var/tmp). This is the
+  execution-side complement to the LaunchAgents/LaunchDaemons plist-creation rule:
+  it catches activation of the agent even when the plist write happened earlier.
+references:
+  - https://attack.mitre.org/techniques/T1543/001/
+  - https://attack.mitre.org/techniques/T1543/004/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.privilege-escalation
+  - attack.t1543.001
+  - attack.t1543.004
+logsource:
+  category: process_creation
+  product: macos
+detection:
+  selection_tool:
+    Image|endswith: '/launchctl'
+    CommandLine|contains:
+      - 'load'
+      - 'bootstrap'
+  selection_path:
+    CommandLine|contains:
+      - '/tmp/'
+      - '/private/tmp/'
+      - '/Users/Shared/'
+      - '/var/tmp/'
+  condition: selection_tool and selection_path
+falsepositives:
+  - Some developer tooling loads agents from a temporary path during install.
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: none
diff --git a/rules/sigma/macos/proc_creation_macos_tcc_db_access.yml b/rules/sigma/macos/proc_creation_macos_tcc_db_access.yml
new file mode 100644
index 0000000..0eb4538
--- /dev/null
+++ b/rules/sigma/macos/proc_creation_macos_tcc_db_access.yml
@@ -0,0 +1,33 @@
+title: TCC Database Access
+id: 829cee70-a60f-4e8a-8b2f-38e1fff83e61
+status: experimental
+description: >
+  Detects a process reading or copying the TCC privacy database (TCC.db), the
+  permission-bypass step of essentially every documented macOS stealer and
+  implant (AMOS and XCSSET lineage). Reading or patching TCC lets malware grant
+  itself access to protected resources.
+references:
+  - https://attack.mitre.org/techniques/T1005/
+  - https://attack.mitre.org/techniques/T1548/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.collection
+  - attack.privilege-escalation
+  - attack.t1005
+  - attack.t1548
+logsource:
+  category: process_creation
+  product: macos
+detection:
+  selection:
+    CommandLine|contains: 'TCC.db'
+  condition: selection
+falsepositives:
+  - MDM and fleet-management tooling querying TCC state; document vendor filters.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: none
diff --git a/rules/sigma/windows/file_event_win_startup_folder_drop.yml b/rules/sigma/windows/file_event_win_startup_folder_drop.yml
new file mode 100644
index 0000000..6b3c421
--- /dev/null
+++ b/rules/sigma/windows/file_event_win_startup_folder_drop.yml
@@ -0,0 +1,40 @@
+title: File Dropped in Startup Folder
+id: 59bbd501-1c61-45c9-940d-9465cabd36c4
+status: experimental
+description: >
+  Detects a file being written into a Start Menu Startup folder, the file-based
+  half of autorun persistence (the registry Run-key half is covered separately).
+  This accounts for roughly half of commodity-malware persistence.
+references:
+  - https://attack.mitre.org/techniques/T1547/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.t1547.001
+logsource:
+  category: file_event
+  product: windows
+detection:
+  selection:
+    TargetFilename|contains: '\Start Menu\Programs\StartUp\'
+  filter_ini:
+    TargetFilename|endswith: '.ini'
+  filter_installer:
+    Image|endswith:
+      - '\msiexec.exe'
+      - '\TrustedInstaller.exe'
+  condition: selection and not (filter_ini or filter_installer)
+falsepositives:
+  - Legitimate installers register startup entries; the installer image filter is
+    the tuning surface.
+level: medium
+rustinel:
+  telemetry:
+    - file_event
+  expected_false_positive_level: medium
+  test_status: manual
+  test_reason: >
+    Windows file_event firing is not yet exercised by the atomic harness (no
+    Windows file rule has a fixture); validated manually with Atomic Red Team
+    T1547.001.
diff --git a/rules/sigma/windows/image_load_win_hunting_unsigned_dll_userwritable.yml b/rules/sigma/windows/image_load_win_hunting_unsigned_dll_userwritable.yml
new file mode 100644
index 0000000..f322a32
--- /dev/null
+++ b/rules/sigma/windows/image_load_win_hunting_unsigned_dll_userwritable.yml
@@ -0,0 +1,41 @@
+title: Unsigned DLL Loaded from User-Writable Path (Hunting)
+id: 3248cbd6-6c77-4b5c-ab44-655e7fd75667
+status: experimental
+description: >
+  Hunting signal for DLL side-loading: an unsigned DLL loaded from a
+  user-writable directory (Users, Temp, ProgramData, AppData). Side-loading is
+  the dominant execution technique of current APT tooling (PlugX / ShadowPad
+  lineage) and many stealers. Noisy — unsigned software is everywhere — so this
+  is hunting-tier pivot data, never a standing alert.
+references:
+  - https://attack.mitre.org/techniques/T1574/002/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.persistence
+  - attack.t1574.002
+logsource:
+  category: image_load
+  product: windows
+detection:
+  selection:
+    Signed: 'false'
+    ImageLoaded|contains:
+      - '\Users\'
+      - '\Temp\'
+      - '\ProgramData\'
+      - '\AppData\'
+  condition: selection
+falsepositives:
+  - Substantial; unsigned third-party software loads DLLs from these paths
+    routinely. Hunting only.
+level: low
+rustinel:
+  telemetry:
+    - image_load
+  expected_false_positive_level: high
+  test_status: manual
+  test_reason: >
+    Hunting-tier signal on the image_load channel, which the atomic harness does
+    not exercise; validated manually by loading an unsigned DLL from %TEMP%.
diff --git a/rules/sigma/windows/image_load_win_susp_automation_dll.yml b/rules/sigma/windows/image_load_win_susp_automation_dll.yml
new file mode 100644
index 0000000..44b1843
--- /dev/null
+++ b/rules/sigma/windows/image_load_win_susp_automation_dll.yml
@@ -0,0 +1,47 @@
+title: Unmanaged PowerShell via Automation DLL in Foreign Host
+id: 86c19f1a-add5-4553-9c24-f76e7fe3da9d
+status: experimental
+description: >
+  Detects System.Management.Automation.dll being loaded by a process other than
+  a known PowerShell host. Cobalt Strike powerpick, Empire psinject and most
+  modern loaders run PowerShell without powershell.exe precisely to evade
+  command-line rules; this catches the runtime instead of the command line.
+  The host allowlist is the intended tuning surface.
+references:
+  - https://attack.mitre.org/techniques/T1059/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.execution
+  - attack.t1059.001
+logsource:
+  category: image_load
+  product: windows
+detection:
+  selection:
+    ImageLoaded|endswith:
+      - '\System.Management.Automation.dll'
+      - '\System.Management.Automation.ni.dll'
+  filter_hosts:
+    Image|endswith:
+      - '\powershell.exe'
+      - '\powershell_ise.exe'
+      - '\pwsh.exe'
+      - '\wsmprovhost.exe'
+      - '\sdiagnhost.exe'
+      - '\mscorsvw.exe'
+      - '\dsac.exe'
+  condition: selection and not filter_hosts
+falsepositives:
+  - Administration and backup tools that embed the PowerShell runtime; add them
+    to the host filter.
+level: high
+rustinel:
+  telemetry:
+    - image_load
+  expected_false_positive_level: medium
+  test_status: manual
+  test_reason: >
+    Reliable image-load firing depends on a runspace-hosting binary that the
+    disposable atomic runners do not ship; validated manually with a
+    PowerShell-runspace host loading the automation DLL.
diff --git a/rules/sigma/windows/net_connection_win_susp_lolbin_outbound.yml b/rules/sigma/windows/net_connection_win_susp_lolbin_outbound.yml
new file mode 100644
index 0000000..631d6fb
--- /dev/null
+++ b/rules/sigma/windows/net_connection_win_susp_lolbin_outbound.yml
@@ -0,0 +1,54 @@
+title: Outbound Connection from Script or LOLBin Host
+id: 717396f6-aff0-49b0-b8f3-53568e276d5c
+status: experimental
+description: >
+  Detects a public-internet outbound connection made by a scripting or LOLBin
+  host (rundll32, mshta, regsvr32, certutil, wscript, cscript). This behavioral
+  net catches C2 from these binaries regardless of command line, complementing
+  the process-creation rules for the same tools and defeating command-line
+  obfuscation. Add internal proxy CIDRs to the private-network filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1071/
+  - https://attack.mitre.org/techniques/T1218/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.command-and-control
+  - attack.defense-evasion
+  - attack.t1071
+  - attack.t1218
+logsource:
+  category: network_connection
+  product: windows
+detection:
+  selection:
+    Image|endswith:
+      - '\rundll32.exe'
+      - '\mshta.exe'
+      - '\regsvr32.exe'
+      - '\certutil.exe'
+      - '\wscript.exe'
+      - '\cscript.exe'
+  filter_private:
+    DestinationIp|cidr:
+      - '10.0.0.0/8'
+      - '172.16.0.0/12'
+      - '192.168.0.0/16'
+      - '127.0.0.0/8'
+      - '169.254.0.0/16'
+      - '::1/128'
+      - 'fe80::/10'
+  condition: selection and not filter_private
+falsepositives:
+  - Environments where these binaries reach an internet-facing internal proxy;
+    add the proxy CIDR to the filter.
+level: medium
+rustinel:
+  telemetry:
+    - network_connection
+  expected_false_positive_level: medium
+  test_status: manual
+  test_reason: >
+    Windows network_connection firing is not yet exercised by the atomic harness
+    (no Windows network rule has a fixture); validated manually with a rundll32
+    beacon to a lab endpoint.
diff --git a/rules/sigma/windows/proc_creation_win_hunting_recon_commands.yml b/rules/sigma/windows/proc_creation_win_hunting_recon_commands.yml
new file mode 100644
index 0000000..734bd25
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_hunting_recon_commands.yml
@@ -0,0 +1,46 @@
+title: Reconnaissance Command Burst (Hunting)
+id: 4aae4b03-4807-428a-ac89-5c5f3cda65e4
+status: experimental
+description: >
+  Hunting signal for the built-in discovery commands that open nearly every
+  hands-on-keyboard intrusion — privilege, group and domain-trust enumeration.
+  These strings are consistently top-ranked in Red Canary and DFIR Report data.
+  Wrong for alerting (administrators and scripts run them too), ideal for triage
+  context and pivoting.
+references:
+  - https://attack.mitre.org/techniques/T1033/
+  - https://attack.mitre.org/techniques/T1482/
+  - https://attack.mitre.org/techniques/T1069/002/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.discovery
+  - attack.t1033
+  - attack.t1482
+  - attack.t1069.002
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    CommandLine|contains:
+      - 'whoami /priv'
+      - 'whoami /groups'
+      - 'nltest /domain_trusts'
+      - 'nltest /dclist'
+      - 'net group "domain admins"'
+      - 'net localgroup administrators'
+  condition: selection
+falsepositives:
+  - Administrators and provisioning scripts run these routinely. Hunting only,
+    never promote to a standing alert.
+level: low
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: high
+  test_status: manual
+  test_reason: >
+    Hunting-tier keyword content whose exact command-line substrings are
+    environment-dependent to reproduce faithfully; validated manually with
+    Atomic Red Team T1033 / T1482.
diff --git a/rules/sigma/windows/proc_creation_win_susp_bcdedit_recovery_tamper.yml b/rules/sigma/windows/proc_creation_win_susp_bcdedit_recovery_tamper.yml
new file mode 100644
index 0000000..9b2a78e
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_susp_bcdedit_recovery_tamper.yml
@@ -0,0 +1,49 @@
+title: Boot Recovery Tampering via bcdedit or wbadmin
+id: e86de5fe-3908-4a95-b4e8-930a93bf4555
+status: experimental
+description: >
+  Detects disabling of Windows automatic boot recovery via bcdedit, or deletion
+  of backup catalogs / system-state backups via wbadmin. These steps fire in
+  virtually every human-operated ransomware chain, usually within seconds of the
+  already-covered vssadmin shadow-copy deletion, and precede encryption.
+references:
+  - https://attack.mitre.org/techniques/T1490/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.impact
+  - attack.t1490
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection_bcdedit:
+    Image|endswith: '\bcdedit.exe'
+    CommandLine|contains:
+      - 'recoveryenabled no'
+      - 'recoveryenabled off'
+      - 'bootstatuspolicy ignoreallfailures'
+  selection_wbadmin_catalog:
+    Image|endswith: '\wbadmin.exe'
+    CommandLine|contains|all:
+      - 'delete'
+      - 'catalog'
+  selection_wbadmin_systemstate:
+    Image|endswith: '\wbadmin.exe'
+    CommandLine|contains|all:
+      - 'delete'
+      - 'systemstatebackup'
+  selection_wbadmin_backup:
+    Image|endswith: '\wbadmin.exe'
+    CommandLine|contains|all:
+      - 'delete'
+      - 'backup'
+  condition: selection_bcdedit or selection_wbadmin_catalog or selection_wbadmin_systemstate or selection_wbadmin_backup
+falsepositives:
+  - Essentially none; no routine administrative workflow disables boot recovery.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/windows/proc_creation_win_susp_bitsadmin_download.yml b/rules/sigma/windows/proc_creation_win_susp_bitsadmin_download.yml
new file mode 100644
index 0000000..0c8220e
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_susp_bitsadmin_download.yml
@@ -0,0 +1,43 @@
+title: BITS Job Download via bitsadmin
+id: d97177dd-c74f-465e-96c1-194cc1dd681d
+status: experimental
+description: >
+  Detects bitsadmin.exe creating a background transfer that downloads a remote
+  URL. BITS is a long-lived ingress-tool-transfer LOLBin that survives reboots
+  and runs outside the requesting process; pairs with the certutil hunting rule
+  to cover the two most common download LOLBins.
+references:
+  - https://attack.mitre.org/techniques/T1197/
+  - https://attack.mitre.org/techniques/T1105/
+  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.command-and-control
+  - attack.t1197
+  - attack.t1105
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection_tool:
+    Image|endswith: '\bitsadmin.exe'
+  selection_transfer:
+    CommandLine|contains|windash:
+      - '/transfer'
+      - '/create'
+      - '/addfile'
+  selection_url:
+    CommandLine|contains:
+      - 'http'
+      - 'ftp'
+  condition: selection_tool and selection_transfer and selection_url
+falsepositives:
+  - Some legacy deployment scripts still use bitsadmin for downloads.
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/windows/proc_creation_win_susp_fsutil_usn_delete.yml b/rules/sigma/windows/proc_creation_win_susp_fsutil_usn_delete.yml
new file mode 100644
index 0000000..b86e40a
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_susp_fsutil_usn_delete.yml
@@ -0,0 +1,32 @@
+title: USN Journal Deletion via fsutil
+id: 596b49d3-561e-49d7-9538-f3115c1c8cfd
+status: experimental
+description: >
+  Detects deletion of the NTFS USN change journal via fsutil, an anti-forensics
+  step common to ransomware (LockBit and others) and hands-on-keyboard
+  intrusions that removes a record of recent file-system activity.
+references:
+  - https://attack.mitre.org/techniques/T1070/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1070
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    Image|endswith: '\fsutil.exe'
+    CommandLine|contains|all:
+      - 'usn'
+      - 'deletejournal'
+  condition: selection
+falsepositives:
+  - Near zero; occasionally disk-repair or imaging scripts.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/windows/proc_creation_win_susp_netsh_portproxy.yml b/rules/sigma/windows/proc_creation_win_susp_netsh_portproxy.yml
new file mode 100644
index 0000000..75de698
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_susp_netsh_portproxy.yml
@@ -0,0 +1,35 @@
+title: Netsh Port-Proxy Tunnel Configuration
+id: 6c46cc68-2e66-4834-b058-0a2cfd115409
+status: experimental
+description: >
+  Detects configuration of a netsh interface portproxy rule, a built-in
+  port-forwarding / pivot mechanism used for lateral movement and to expose
+  internal services. Documented against domain controllers in numerous
+  intrusions, including Volt Typhoon-style living-off-the-land tradecraft.
+references:
+  - https://attack.mitre.org/techniques/T1090/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.command-and-control
+  - attack.lateral-movement
+  - attack.t1090.001
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection:
+    Image|endswith: '\netsh.exe'
+    CommandLine|contains|all:
+      - 'interface'
+      - 'portproxy'
+      - 'add'
+  condition: selection
+falsepositives:
+  - Rare legitimate port-forwarding setups by administrators.
+level: medium
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/windows/proc_creation_win_susp_procdump_lsass.yml b/rules/sigma/windows/proc_creation_win_susp_procdump_lsass.yml
new file mode 100644
index 0000000..ecca639
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_susp_procdump_lsass.yml
@@ -0,0 +1,44 @@
+title: LSASS Memory Dump via Procdump
+id: 04d66f93-97ae-4674-96a8-1bb524a1da60
+status: experimental
+description: >
+  Detects Sysinternals Procdump being used to dump the memory of LSASS for
+  offline credential extraction, including when the binary has been renamed. The
+  tool is identified by its original file name, by its image name, or by the
+  characteristic full-dump flags, and every path is constrained to an LSASS
+  target to stay high-signal. Procdump is the most common real-world LSASS dump
+  method because it is Microsoft-signed and allowlist-friendly.
+references:
+  - https://attack.mitre.org/techniques/T1003/001/
+  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Procdump/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.credential-access
+  - attack.t1003.001
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection_lsass:
+    CommandLine|contains: 'lsass'
+  selection_name:
+    OriginalFileName: 'procdump'
+  selection_image:
+    Image|endswith:
+      - '\procdump.exe'
+      - '\procdump64.exe'
+  selection_flags:
+    CommandLine|contains|windash:
+      - ' -ma '
+      - ' -mm '
+  condition: selection_lsass and (selection_name or selection_image or selection_flags)
+falsepositives:
+  - Security teams that intentionally dump LSASS for forensic capture; add a
+    host-level exception for those hosts rather than weakening the rule.
+level: critical
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/windows/proc_creation_win_susp_sc_stop_security.yml b/rules/sigma/windows/proc_creation_win_susp_sc_stop_security.yml
new file mode 100644
index 0000000..7a7c5b4
--- /dev/null
+++ b/rules/sigma/windows/proc_creation_win_susp_sc_stop_security.yml
@@ -0,0 +1,54 @@
+title: Security Service Stop or Disable via sc or net
+id: 43c59081-d5ec-4153-9e26-04e66e07461a
+status: experimental
+description: >
+  Detects use of sc.exe or net.exe to stop, disable or delete a security service
+  (Microsoft Defender, Defender for Endpoint, the Windows Security Center,
+  Sysmon, or a common third-party EDR). This precedes payload deployment in most
+  ransomware playbooks and covers the service-control route the Defender registry
+  rule does not see. The service list is the intended tuning surface.
+references:
+  - https://attack.mitre.org/techniques/T1562/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1562.001
+logsource:
+  category: process_creation
+  product: windows
+detection:
+  selection_tool:
+    Image|endswith:
+      - '\sc.exe'
+      - '\net.exe'
+      - '\net1.exe'
+    CommandLine|contains:
+      - 'stop'
+      - 'config'
+      - 'delete'
+      - 'disabled'
+  selection_service:
+    CommandLine|contains:
+      - 'WinDefend'
+      - 'Sense'
+      - 'wscsvc'
+      - 'SecurityHealthService'
+      - 'WdNisSvc'
+      - 'Sysmon'
+      - 'Sysmon64'
+      - 'CSFalconService'
+      - 'SentinelAgent'
+      - 'xagt'
+      - 'MsSecFlt'
+      - 'MDCoreSvc'
+  condition: selection_tool and selection_service
+falsepositives:
+  - Authorized AV migration or uninstall maintenance; the service list is the
+    tuning surface.
+level: high
+rustinel:
+  telemetry:
+    - process_creation
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/windows/ps_script_win_susp_amsi_bypass.yml b/rules/sigma/windows/ps_script_win_susp_amsi_bypass.yml
new file mode 100644
index 0000000..37e3ea6
--- /dev/null
+++ b/rules/sigma/windows/ps_script_win_susp_amsi_bypass.yml
@@ -0,0 +1,41 @@
+title: AMSI Bypass Pattern in PowerShell ScriptBlock
+id: 31ddbaff-1a32-4eb6-b7ce-647b59aeb901
+status: experimental
+description: >
+  Detects PowerShell ScriptBlock content that references the internal AMSI
+  objects and fields used by nearly every published AMSI bypass (patching
+  amsiInitFailed, reflecting into AmsiUtils, or targeting AmsiScanBuffer /
+  AmsiOpenSession). Almost every PowerShell offensive framework disables AMSI
+  first, so catching the bypass catches the family rather than the sample.
+references:
+  - https://attack.mitre.org/techniques/T1562/001/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.defense-evasion
+  - attack.t1562.001
+logsource:
+  category: ps_script
+  product: windows
+detection:
+  selection:
+    ScriptBlockText|contains:
+      - 'amsiInitFailed'
+      - 'AmsiUtils'
+      - 'AmsiScanBuffer'
+      - 'amsiContext'
+      - 'AmsiOpenSession'
+  condition: selection
+falsepositives:
+  - Security tooling and red-team frameworks; content-wise near zero, but
+    ScriptBlock volume argues for Advanced until burn-in.
+level: high
+rustinel:
+  telemetry:
+    - ps_script
+  expected_false_positive_level: medium
+  test_status: manual
+  test_reason: >
+    Requires PowerShell ScriptBlock logging to be enabled on the host, which the
+    atomic firing runners do not configure; validated manually with Atomic Red
+    Team T1562.001 AMSI bypass atomics.
diff --git a/rules/sigma/windows/registry_event_win_susp_ifeo_debugger.yml b/rules/sigma/windows/registry_event_win_susp_ifeo_debugger.yml
new file mode 100644
index 0000000..753317a
--- /dev/null
+++ b/rules/sigma/windows/registry_event_win_susp_ifeo_debugger.yml
@@ -0,0 +1,53 @@
+title: IFEO Debugger or SilentProcessExit Hijack
+id: cda4a133-fe67-4aa6-815d-f8c69ff16828
+status: experimental
+description: >
+  Detects registry changes that attach a Debugger to an Image File Execution
+  Options entry, set an IFEO GlobalFlag, or register a SilentProcessExit
+  MonitorProcess. The sticky-keys / accessibility-feature variant of this yields
+  a SYSTEM shell at the lock screen with no malware on disk and is still
+  routinely found in incident response.
+  Note: Rustinel exposes the registry key path in TargetObject and the value name
+  in Details, so the watched value names are matched in either field.
+references:
+  - https://attack.mitre.org/techniques/T1546/008/
+  - https://attack.mitre.org/techniques/T1546/012/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.privilege-escalation
+  - attack.t1546.008
+  - attack.t1546.012
+logsource:
+  category: registry_event
+  product: windows
+detection:
+  selection_ifeo_path:
+    TargetObject|contains: '\Image File Execution Options\'
+  ifeo_value_in_keyname:
+    TargetObject|contains:
+      - 'Debugger'
+      - 'GlobalFlag'
+  ifeo_value_in_details:
+    Details|contains:
+      - 'Debugger'
+      - 'GlobalFlag'
+  selection_spe_path:
+    TargetObject|contains: '\SilentProcessExit\'
+  spe_value_in_keyname:
+    TargetObject|contains: 'MonitorProcess'
+  spe_value_in_details:
+    Details|contains: 'MonitorProcess'
+  condition: >
+    (selection_ifeo_path and (ifeo_value_in_keyname or ifeo_value_in_details))
+    or (selection_spe_path and (spe_value_in_keyname or spe_value_in_details))
+falsepositives:
+  - Developer tooling that attaches a debugger on launch (WinDbg, gflags) on dev
+    workstations; filter those hosts rather than weakening the rule.
+level: high
+rustinel:
+  telemetry:
+    - registry_event
+  expected_false_positive_level: low
+  test_status: atomic
diff --git a/rules/sigma/windows/registry_event_win_winlogon_helper.yml b/rules/sigma/windows/registry_event_win_winlogon_helper.yml
new file mode 100644
index 0000000..e939bd8
--- /dev/null
+++ b/rules/sigma/windows/registry_event_win_winlogon_helper.yml
@@ -0,0 +1,45 @@
+title: Winlogon Helper DLL or Shell Modification
+id: 52b94494-756b-40d7-af01-8d0c7d54a6cc
+status: experimental
+description: >
+  Detects modification of Winlogon Userinit, Shell, Notify or Taskman values,
+  which run an attacker-chosen binary at logon. Complements the Run-key
+  persistence rule with a different key in the same technique family; commonly
+  abused by commodity stealers.
+  Note: Rustinel exposes the registry key path in TargetObject and the value name
+  in Details, so the watched value names are matched in either field.
+references:
+  - https://attack.mitre.org/techniques/T1547/004/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.privilege-escalation
+  - attack.t1547.004
+logsource:
+  category: registry_event
+  product: windows
+detection:
+  selection_path:
+    TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Winlogon'
+  value_in_keyname:
+    TargetObject|contains:
+      - '\Userinit'
+      - '\Shell'
+      - '\Notify'
+      - '\Taskman'
+  value_in_details:
+    Details|contains:
+      - 'Userinit'
+      - 'Shell'
+      - 'Notify'
+      - 'Taskman'
+  condition: selection_path and (value_in_keyname or value_in_details)
+falsepositives:
+  - VDI and kiosk products legitimately replace the Shell value; tune per host.
+level: medium
+rustinel:
+  telemetry:
+    - registry_event
+  expected_false_positive_level: medium
+  test_status: atomic
diff --git a/rules/sigma/windows/wmi_event_win_susp_subscription.yml b/rules/sigma/windows/wmi_event_win_susp_subscription.yml
new file mode 100644
index 0000000..518b9b2
--- /dev/null
+++ b/rules/sigma/windows/wmi_event_win_susp_subscription.yml
@@ -0,0 +1,44 @@
+title: WMI Event Subscription Persistence
+id: d6adbfee-548b-4def-9e49-8e6940251957
+status: experimental
+description: >
+  Detects creation of a WMI event subscription — an __EventFilter, a
+  CommandLineEventConsumer / ActiveScriptEventConsumer, or the
+  __FilterToConsumerBinding that ties them together. This is a classic fileless
+  persistence mechanism that survives reboot and is invisible to file- and
+  registry-focused rules.
+  Note: Rustinel surfaces the WMI operation and touched class in the Operation
+  field, so the rule keys on the persistence-related consumer/filter classes
+  there rather than on a specific EventType shape.
+references:
+  - https://attack.mitre.org/techniques/T1546/003/
+author: rustinel-rules
+date: 2026-07-09
+tags:
+  - attack.persistence
+  - attack.privilege-escalation
+  - attack.t1546.003
+logsource:
+  category: wmi_event
+  product: windows
+detection:
+  selection:
+    Operation|contains:
+      - 'CommandLineEventConsumer'
+      - 'ActiveScriptEventConsumer'
+      - '__EventFilter'
+      - '__FilterToConsumerBinding'
+  condition: selection
+falsepositives:
+  - SCCM and some enterprise monitoring agents create legitimate subscriptions;
+    filter Operation values for the known-good consumer names on those hosts.
+level: high
+rustinel:
+  telemetry:
+    - wmi_event
+  expected_false_positive_level: low
+  test_status: manual
+  test_reason: >
+    Firing requires registering a persistent WMI CommandLineEventConsumer, which
+    the disposable-runner atomic harness deliberately avoids; validated manually
+    with Atomic Red Team T1546.003.
diff --git a/rules/yara/linux/lnx_msfvenom_stager.yar b/rules/yara/linux/lnx_msfvenom_stager.yar
new file mode 100644
index 0000000..863f99c
--- /dev/null
+++ b/rules/yara/linux/lnx_msfvenom_stager.yar
@@ -0,0 +1,26 @@
+rule lnx_msfvenom_meterpreter_stager
+{
+    meta:
+        id = "yara-lnx-msfvenom-stager"
+        description = "Detects Metasploit / Mettle (Linux Meterpreter) stage markers in ELF images. Metasploit is the highest-volume commodity payload generator."
+        author = "rustinel-rules"
+        date = "2026-07-09"
+        reference = "https://attack.mitre.org/software/S0002/"
+        attack = "T1105"
+        level = "high"
+        os = "linux"
+        telemetry = "file_scan"
+        expected_false_positive_level = "low"
+        test_status = "atomic"
+
+    strings:
+        $m1 = "mettle" ascii nocase
+        $m2 = "meterpreter" ascii nocase
+        $m3 = "core_channel_open" ascii nocase
+        $m4 = "stdapi_" ascii nocase
+        $m5 = "libmettle" ascii nocase
+        $m6 = "metsrv" ascii nocase
+
+    condition:
+        uint32(0) == 0x464c457f and 2 of ($m*)
+}
diff --git a/rules/yara/linux/lnx_susp_sliver_implant.yar b/rules/yara/linux/lnx_susp_sliver_implant.yar
new file mode 100644
index 0000000..1a37960
--- /dev/null
+++ b/rules/yara/linux/lnx_susp_sliver_implant.yar
@@ -0,0 +1,27 @@
+rule lnx_susp_sliver_implant
+{
+    meta:
+        id = "yara-lnx-sliver-implant"
+        description = "Detects Sliver C2 implant artifacts (sliverpb protobuf package, RPC and transport markers) in Linux ELF images. Sliver has replaced Cobalt Strike in much commodity and ransomware tradecraft."
+        author = "rustinel-rules"
+        date = "2026-07-09"
+        reference = "https://attack.mitre.org/software/S1049/"
+        attack = "T1219"
+        level = "high"
+        os = "linux"
+        telemetry = "file_scan"
+        expected_false_positive_level = "low"
+        test_status = "manual"
+        test_reason = "Advanced-tier YARA fixture is exercised manually; a Go implant with garbled strings will not match, matching this rule's documented scope."
+
+    strings:
+        $s1 = "sliverpb" ascii nocase
+        $s2 = ".(*Sliver" ascii
+        $s3 = "bishopfox/sliver" ascii nocase
+        $s4 = "SliverRPC" ascii nocase
+        $s5 = "sliver/protobuf" ascii nocase
+        $s6 = "GetReconfigureReq" ascii
+
+    condition:
+        uint32(0) == 0x464c457f and 2 of ($s*)
+}
diff --git a/rules/yara/windows/win_msfvenom_stager.yar b/rules/yara/windows/win_msfvenom_stager.yar
new file mode 100644
index 0000000..95e71fd
--- /dev/null
+++ b/rules/yara/windows/win_msfvenom_stager.yar
@@ -0,0 +1,26 @@
+rule win_msfvenom_meterpreter_stager
+{
+    meta:
+        id = "yara-win-msfvenom-stager"
+        description = "Detects Metasploit / Meterpreter Windows stager and stage markers (metsrv, ReflectiveLoader, channel/stdapi command strings) in PE images."
+        author = "rustinel-rules"
+        date = "2026-07-09"
+        reference = "https://attack.mitre.org/software/S0002/"
+        attack = "T1105"
+        level = "high"
+        os = "windows"
+        telemetry = "file_scan"
+        expected_false_positive_level = "low"
+        test_status = "atomic"
+
+    strings:
+        $m1 = "metsrv" ascii wide nocase
+        $m2 = "ReflectiveLoader" ascii wide
+        $m3 = "meterpreter" ascii wide nocase
+        $m4 = "core_channel_open" ascii wide nocase
+        $m5 = "stdapi_" ascii wide nocase
+        $m6 = "metsrv.dll" ascii wide nocase
+
+    condition:
+        uint16(0) == 0x5A4D and 2 of ($m*)
+}
diff --git a/rules/yara/windows/win_susp_cobaltstrike_beacon.yar b/rules/yara/windows/win_susp_cobaltstrike_beacon.yar
new file mode 100644
index 0000000..0ea2788
--- /dev/null
+++ b/rules/yara/windows/win_susp_cobaltstrike_beacon.yar
@@ -0,0 +1,33 @@
+rule win_susp_cobaltstrike_beacon
+{
+    meta:
+        id = "yara-win-cobaltstrike-beacon"
+        description = "Detects Cobalt Strike beacon stager and configuration artifacts in Windows PE images (beacon command markers, default named-pipe and spawnto strings). Caveat: on-disk beacons are usually packed, so a disk scan alone misses many samples; enable scanner.yara_memory_* memory scanning for full coverage."
+        author = "rustinel-rules"
+        date = "2026-07-09"
+        reference = "https://attack.mitre.org/software/S0154/"
+        attack = "T1219"
+        level = "high"
+        os = "windows"
+        telemetry = "file_scan"
+        expected_false_positive_level = "low"
+        test_status = "manual"
+        test_reason = "On-disk beacons are typically packed; this rule is the primary beneficiary of optional memory scanning and is validated manually rather than in the disk-scan atomic harness."
+
+    strings:
+        $b1 = "beacon.dll" ascii wide nocase
+        $b2 = "beacon.x64.dll" ascii wide nocase
+        $b3 = "%s as %s\\%s: %d" ascii
+        $b4 = "ReflectiveLoader" ascii
+        $b5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%s" ascii
+        $spawn1 = "\\\\%s\\pipe\\msagent_" ascii wide
+        $spawn2 = "\\\\.\\pipe\\MSSE-" ascii wide
+        $spawn3 = "could not spawn %s" ascii
+
+    condition:
+        uint16(0) == 0x5A4D and
+        (
+            2 of ($b*) or
+            1 of ($spawn*)
+        )
+}
diff --git a/rules/yara/windows/win_susp_sliver_implant.yar b/rules/yara/windows/win_susp_sliver_implant.yar
new file mode 100644
index 0000000..c6a92bb
--- /dev/null
+++ b/rules/yara/windows/win_susp_sliver_implant.yar
@@ -0,0 +1,27 @@
+rule win_susp_sliver_implant
+{
+    meta:
+        id = "yara-win-sliver-implant"
+        description = "Detects Sliver C2 implant artifacts (sliverpb protobuf package, RPC and transport markers) in Windows PE images. Sliver has replaced Cobalt Strike in much commodity and ransomware tradecraft."
+        author = "rustinel-rules"
+        date = "2026-07-09"
+        reference = "https://attack.mitre.org/software/S1049/"
+        attack = "T1219"
+        level = "high"
+        os = "windows"
+        telemetry = "file_scan"
+        expected_false_positive_level = "low"
+        test_status = "manual"
+        test_reason = "Advanced-tier YARA fixture is exercised manually; a Go implant with garbled strings will not match, matching this rule's documented scope."
+
+    strings:
+        $s1 = "sliverpb" ascii nocase
+        $s2 = ".(*Sliver" ascii
+        $s3 = "bishopfox/sliver" ascii nocase
+        $s4 = "SliverRPC" ascii nocase
+        $s5 = "sliver/protobuf" ascii nocase
+        $s6 = "GetReconfigureReq" ascii
+
+    condition:
+        uint16(0) == 0x5A4D and 2 of ($s*)
+}
diff --git a/rules/yara/windows/win_susp_xmrig_coinminer.yar b/rules/yara/windows/win_susp_xmrig_coinminer.yar
new file mode 100644
index 0000000..cc2da00
--- /dev/null
+++ b/rules/yara/windows/win_susp_xmrig_coinminer.yar
@@ -0,0 +1,34 @@
+rule win_susp_xmrig_coinminer
+{
+    meta:
+        id = "yara-win-xmrig-coinminer"
+        description = "Detects characteristic XMRig and Monero coinminer strings in Windows PE binaries. Windows parity for the existing Linux and macOS coinminer rules."
+        author = "rustinel-rules"
+        date = "2026-07-09"
+        reference = "https://attack.mitre.org/software/S0597/"
+        attack = "T1496"
+        level = "high"
+        os = "windows"
+        telemetry = "file_scan"
+        expected_false_positive_level = "low"
+        test_status = "atomic"
+
+    strings:
+        $xmrig = "xmrig" ascii wide nocase
+        $miner1 = "stratum+tcp://" ascii nocase
+        $miner2 = "stratum+ssl://" ascii nocase
+        $miner3 = "donate-level" ascii nocase
+        $miner4 = "randomx" ascii nocase
+        $miner5 = "cryptonight" ascii nocase
+        $miner6 = "monero" ascii nocase
+        $pool1 = "pool.minexmr" ascii nocase
+        $pool2 = "supportxmr" ascii nocase
+
+    condition:
+        uint16(0) == 0x5A4D and
+        (
+            $xmrig or
+            4 of ($miner*) or
+            (2 of ($miner*) and 1 of ($pool*))
+        )
+}
diff --git a/tests/atomic/atomics/linux/backdoor_account.sh b/tests/atomic/atomics/linux/backdoor_account.sh
new file mode 100644
index 0000000..608f205
--- /dev/null
+++ b/tests/atomic/atomics/linux/backdoor_account.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Atomic test - rule 66fd4673-d86b-41d1-ba33-60d7c66dc962
+#   "Backdoor Account Creation (Duplicate UID 0)"  (process_creation)
+#
+# Copies /bin/sh to a file whose basename is exactly useradd and runs it with the
+# duplicate-UID-0 command line (-o -u 0). The -c body is 'sleep 1; :' — the
+# trailing no-op keeps the shell from tail-exec'ing into sleep (which would drop
+# its useradd Image and args), so it lives ~1s as useradd for /proc enrichment;
+# no account is created.
+set -u
+# Stage OUTSIDE /tmp: the engine emits one Sigma alert per event (first match
+# wins), so a /tmp path would be shadowed by the broad "Execution from
+# World-Writable / Temporary Directory" rule. /opt is not world-writable.
+DIR=/opt/rustinel_atomic_useradd.d
+BIN="$DIR/useradd"
+mkdir -p "$DIR" 2>/dev/null || true
+cp /bin/sh "$BIN" 2>/dev/null || cp /usr/bin/sh "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+timeout 3 "$BIN" -c 'sleep 1; :' -o -u 0 rustinelbackdoor >/dev/null 2>&1 || true
+rm -rf "$DIR" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/base64_pipe_shell.sh b/tests/atomic/atomics/linux/base64_pipe_shell.sh
new file mode 100644
index 0000000..d9bed4c
--- /dev/null
+++ b/tests/atomic/atomics/linux/base64_pipe_shell.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Atomic test - rule d24c4943-3e22-481f-99ee-ca631b8a77af
+#   "Base64-Decode Piped to Shell"  (process_creation)
+#
+# Shell command line that base64-decodes a benign payload ("id") and pipes it
+# into bash. The trailing sleep keeps the outer shell alive long enough for
+# /proc command-line enrichment; the command line is what the rule detects.
+set -u
+timeout 5 bash -c 'echo aWQK | base64 -d | bash; sleep 1' >/dev/null 2>&1 || true
+exit 0
diff --git a/tests/atomic/atomics/linux/chmod_suid.sh b/tests/atomic/atomics/linux/chmod_suid.sh
new file mode 100644
index 0000000..1065b9c
--- /dev/null
+++ b/tests/atomic/atomics/linux/chmod_suid.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Atomic test - rule 7a34ffc3-adbc-4d9d-94a4-4bd33ac05cc3
+#   "SUID/SGID Bit Added via chmod"  (process_creation)
+#
+# Copies /bin/sh to a file whose basename is exactly chmod and runs it with a
+# u+s command line. The -c body is 'sleep 1; :' — the trailing no-op keeps the
+# shell from tail-exec'ing into sleep (which would drop its chmod Image and
+# args), so it lives ~1s as chmod for /proc enrichment; no permission bits are
+# actually changed.
+set -u
+# Stage OUTSIDE /tmp: the engine emits one Sigma alert per event (first match
+# wins), so a /tmp path would be shadowed by the broad "Execution from
+# World-Writable / Temporary Directory" rule. /opt is not world-writable.
+DIR=/opt/rustinel_atomic_chmod.d
+BIN="$DIR/chmod"
+mkdir -p "$DIR" 2>/dev/null || true
+cp /bin/sh "$BIN" 2>/dev/null || cp /usr/bin/sh "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+timeout 3 "$BIN" -c 'sleep 1; :' u+s /tmp/rustinel_atomic_target >/dev/null 2>&1 || true
+rm -rf "$DIR" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/kmod_load_susp_path.sh b/tests/atomic/atomics/linux/kmod_load_susp_path.sh
new file mode 100644
index 0000000..15e0a5c
--- /dev/null
+++ b/tests/atomic/atomics/linux/kmod_load_susp_path.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Atomic test - rule 3f32d825-006a-45e9-b5a9-6e7edeeff13c
+#   "Kernel Module Load from Suspicious Path"  (process_creation)
+#
+# Copies /bin/sh to a file whose basename is exactly insmod and runs it with a
+# /tmp module path on the command line. The -c body is 'sleep 1; :' — the
+# trailing no-op keeps the shell from tail-exec'ing into sleep (which would drop
+# its insmod Image and args), so it lives ~1s as insmod for /proc enrichment;
+# no module is loaded.
+set -u
+# Stage OUTSIDE /tmp: the engine emits one Sigma alert per event (first match
+# wins), so a /tmp path would be shadowed by the broad "Execution from
+# World-Writable / Temporary Directory" rule. /opt is not world-writable.
+DIR=/opt/rustinel_atomic_insmod.d
+BIN="$DIR/insmod"
+mkdir -p "$DIR" 2>/dev/null || true
+cp /bin/sh "$BIN" 2>/dev/null || cp /usr/bin/sh "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+timeout 3 "$BIN" -c 'sleep 1; :' /tmp/rustinel_atomic_mod.ko >/dev/null 2>&1 || true
+rm -rf "$DIR" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/log_clear.sh b/tests/atomic/atomics/linux/log_clear.sh
new file mode 100644
index 0000000..0a40c95
--- /dev/null
+++ b/tests/atomic/atomics/linux/log_clear.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Atomic test - rule 6b124b53-1d4b-48a2-86b7-4df9bf43de61
+#   "System Log Clearing (journal and /var/log)"  (process_creation)
+#
+# Copies /bin/sh to a file whose basename is exactly journalctl and runs it with
+# a --vacuum command line. The -c body is 'sleep 1; :' — the trailing no-op keeps
+# the shell from tail-exec'ing into sleep (which would drop its journalctl Image
+# and args), so it lives ~1s as journalctl for /proc enrichment; no journal is
+# actually vacuumed.
+set -u
+# Stage OUTSIDE /tmp: the engine emits one Sigma alert per event (first match
+# wins), so a /tmp path would be shadowed by the broad "Execution from
+# World-Writable / Temporary Directory" rule. /opt is not world-writable.
+DIR=/opt/rustinel_atomic_journalctl.d
+BIN="$DIR/journalctl"
+mkdir -p "$DIR" 2>/dev/null || true
+cp /bin/sh "$BIN" 2>/dev/null || cp /usr/bin/sh "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+timeout 3 "$BIN" -c 'sleep 1; :' --vacuum-size=1M >/dev/null 2>&1 || true
+rm -rf "$DIR" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/msfvenom_yara_fixture.sh b/tests/atomic/atomics/linux/msfvenom_yara_fixture.sh
new file mode 100644
index 0000000..c42bcb0
--- /dev/null
+++ b/tests/atomic/atomics/linux/msfvenom_yara_fixture.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Atomic test - rule yara-lnx-msfvenom-stager
+#   "Metasploit / Mettle (Linux Meterpreter) stage markers"  (yara file_scan)
+#
+# Copies /bin/true, appends Meterpreter/Mettle marker strings as an ELF overlay,
+# executes the copy, then removes it. The overlay does not affect execution.
+set -u
+BIN=/tmp/rustinel_atomic_msfvenom
+cp /bin/true "$BIN" 2>/dev/null || cp /usr/bin/true "$BIN" 2>/dev/null || true
+printf '%s\n' 'mettle' 'meterpreter' 'core_channel_open' 'stdapi_sys_config' 'libmettle' >> "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+"$BIN" >/dev/null 2>&1 || true
+rm -f "$BIN" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/nc_exec_reverse_shell.sh b/tests/atomic/atomics/linux/nc_exec_reverse_shell.sh
new file mode 100644
index 0000000..886bc28
--- /dev/null
+++ b/tests/atomic/atomics/linux/nc_exec_reverse_shell.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Atomic test - rule 1adaaaca-bfcf-46fe-9bd1-4b475d7bc827
+#   "Netcat or Socat Reverse Shell Execution"  (process_creation)
+#
+# Copies /bin/sh to a file whose basename is exactly nc and runs it with an
+# execute-flag command line. The -c body is 'sleep 1; :' — the trailing no-op
+# keeps the shell from tail-exec'ing into sleep (which would drop its nc Image
+# and args), so it lives ~1s as nc for /proc command-line enrichment; the
+# -e /bin/sh tokens are the exact shape the rule keys on. Nothing connects.
+set -u
+# Stage the renamed copy OUTSIDE /tmp: the engine emits one Sigma alert per
+# process event (first match wins), so a /tmp path would be shadowed by the
+# broad "Execution from World-Writable / Temporary Directory" rule before this
+# rule is reached. /opt is not world-writable, so this rule is the sole match.
+DIR=/opt/rustinel_atomic_nc.d
+BIN="$DIR/nc"
+mkdir -p "$DIR" 2>/dev/null || true
+cp /bin/sh "$BIN" 2>/dev/null || cp /usr/bin/sh "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+timeout 3 "$BIN" -c 'sleep 1; :' -e /bin/sh >/dev/null 2>&1 || true
+rm -rf "$DIR" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/stop_security_services.sh b/tests/atomic/atomics/linux/stop_security_services.sh
new file mode 100644
index 0000000..a658696
--- /dev/null
+++ b/tests/atomic/atomics/linux/stop_security_services.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Atomic test - rule 0cb59840-b420-4332-b7d1-2c3d4343901f
+#   "Security Service Stop (auditd / AppArmor / SELinux / EDR)"  (process_creation)
+#
+# Copies /bin/sh to a file whose basename is exactly systemctl and runs it with a
+# "stop auditd" command line. The -c body is 'sleep 1; :' — the trailing no-op
+# keeps the shell from tail-exec'ing into sleep (which would drop its systemctl
+# Image and args), so it lives ~1s as systemctl for /proc enrichment; no service
+# is actually stopped.
+set -u
+# Stage OUTSIDE /tmp: the engine emits one Sigma alert per event (first match
+# wins), so a /tmp path would be shadowed by the broad "Execution from
+# World-Writable / Temporary Directory" rule. /opt is not world-writable.
+DIR=/opt/rustinel_atomic_systemctl.d
+BIN="$DIR/systemctl"
+mkdir -p "$DIR" 2>/dev/null || true
+cp /bin/sh "$BIN" 2>/dev/null || cp /usr/bin/sh "$BIN" 2>/dev/null || true
+chmod 0755 "$BIN" 2>/dev/null || true
+timeout 3 "$BIN" -c 'sleep 1; :' stop auditd >/dev/null 2>&1 || true
+rm -rf "$DIR" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/udev_persistence.sh b/tests/atomic/atomics/linux/udev_persistence.sh
new file mode 100644
index 0000000..c3dbd42
--- /dev/null
+++ b/tests/atomic/atomics/linux/udev_persistence.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Atomic test - rule 1bb5e9e4-f17e-476e-8e77-aaa1858f12f7
+#   "udev Rules Persistence"  (file_event)
+#
+# Drops a harmless udev rules file under /etc/udev/rules.d, then removes it.
+set -u
+FILE=/etc/udev/rules.d/rustinel_atomic.rules
+printf '%s\n' '# rustinel atomic udev rule' > "$FILE" 2>/dev/null || true
+sleep 1
+rm -f "$FILE" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/linux/webshell_write.sh b/tests/atomic/atomics/linux/webshell_write.sh
new file mode 100644
index 0000000..cb3e730
--- /dev/null
+++ b/tests/atomic/atomics/linux/webshell_write.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Atomic test - rule e96a9b85-26f6-4251-a26b-361d4b6761ef
+#   "Webshell Written by Web-Server Process"  (file_event)
+#
+# Copies /bin/sh to a file named nginx and has it write a .php file, emitting a
+# "web-server process creates a server-side script" file-create event. The
+# copied shell then sleeps briefly so its process is attributed. Harmless
+# content, cleaned up after.
+set -u
+WEB=/tmp/nginx
+SHELL_PHP=/tmp/rustinel_atomic_shell.php
+cp /bin/sh "$WEB" 2>/dev/null || cp /usr/bin/sh "$WEB" 2>/dev/null || true
+chmod 0755 "$WEB" 2>/dev/null || true
+timeout 3 "$WEB" -c "echo '<?php // rustinel atomic ?>' > $SHELL_PHP; sleep 1" >/dev/null 2>&1 || true
+rm -f "$WEB" "$SHELL_PHP" 2>/dev/null || true
+exit 0
diff --git a/tests/atomic/atomics/windows/bcdedit_recovery_tamper.ps1 b/tests/atomic/atomics/windows/bcdedit_recovery_tamper.ps1
new file mode 100644
index 0000000..5d73569
--- /dev/null
+++ b/tests/atomic/atomics/windows/bcdedit_recovery_tamper.ps1
@@ -0,0 +1,13 @@
+# Atomic test - rule e86de5fe-3908-4a95-b4e8-930a93bf4555
+#   "Boot Recovery Tampering via bcdedit or wbadmin"  (process_creation)
+#
+# Copies cmd.exe to bcdedit.exe and emits the recovery-disable command-line
+# shape without changing any real boot configuration.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-bcdedit-atomic'
+$bin = Join-Path $dir 'bcdedit.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+& $bin /c echo recoveryenabled no | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/bitsadmin_download.ps1 b/tests/atomic/atomics/windows/bitsadmin_download.ps1
new file mode 100644
index 0000000..164618b
--- /dev/null
+++ b/tests/atomic/atomics/windows/bitsadmin_download.ps1
@@ -0,0 +1,13 @@
+# Atomic test - rule d97177dd-c74f-465e-96c1-194cc1dd681d
+#   "BITS Job Download via bitsadmin"  (process_creation)
+#
+# Copies cmd.exe to bitsadmin.exe and emits a /transfer ... http command-line
+# shape without creating any real BITS job.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-bitsadmin-atomic'
+$bin = Join-Path $dir 'bitsadmin.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+& $bin /c echo /transfer atomicjob http://127.0.0.1/x C:\x | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/fsutil_usn_delete.ps1 b/tests/atomic/atomics/windows/fsutil_usn_delete.ps1
new file mode 100644
index 0000000..785b1e1
--- /dev/null
+++ b/tests/atomic/atomics/windows/fsutil_usn_delete.ps1
@@ -0,0 +1,13 @@
+# Atomic test - rule 596b49d3-561e-49d7-9538-f3115c1c8cfd
+#   "USN Journal Deletion via fsutil"  (process_creation)
+#
+# Copies cmd.exe to fsutil.exe and emits the usn deletejournal command-line
+# shape without touching any real change journal.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-fsutil-atomic'
+$bin = Join-Path $dir 'fsutil.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+& $bin /c echo usn deletejournal /D C: | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/ifeo_debugger.ps1 b/tests/atomic/atomics/windows/ifeo_debugger.ps1
new file mode 100644
index 0000000..1edef46
--- /dev/null
+++ b/tests/atomic/atomics/windows/ifeo_debugger.ps1
@@ -0,0 +1,14 @@
+# Atomic test - rule cda4a133-fe67-4aa6-815d-f8c69ff16828
+#   "IFEO Debugger or SilentProcessExit Hijack"  (registry_event)
+#
+# Creates an Image File Execution Options key whose path ends in the watched
+# Debugger value name, under HKCU only, then removes it. Registry telemetry
+# exposes the key path but not the value name.
+$ErrorActionPreference = 'SilentlyContinue'
+$base = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rustinel_atomic.exe'
+$key = "$base\Debugger"
+New-Item -Path $key -Force | Out-Null
+New-ItemProperty -Path $key -Name 'AtomicValue' -Value 'x' -PropertyType String -Force | Out-Null
+Start-Sleep -Seconds 1
+Remove-Item $base -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/msfvenom_yara_fixture.ps1 b/tests/atomic/atomics/windows/msfvenom_yara_fixture.ps1
new file mode 100644
index 0000000..2676ad1
--- /dev/null
+++ b/tests/atomic/atomics/windows/msfvenom_yara_fixture.ps1
@@ -0,0 +1,14 @@
+# Atomic test - rule yara-win-msfvenom-stager
+#   "Metasploit / Meterpreter Windows stager markers"  (yara file_scan)
+#
+# Copies cmd.exe, appends Meterpreter stage marker strings as a PE overlay,
+# executes the copy, then removes it. The overlay does not affect execution.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-msfvenom-atomic'
+$bin = Join-Path $dir 'rustinel_msfvenom_fixture.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+[IO.File]::AppendAllText($bin, "metsrv.dll`nReflectiveLoader`nmeterpreter`ncore_channel_open`nstdapi_sys_config`n")
+& $bin /c exit 0 | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/netsh_portproxy.ps1 b/tests/atomic/atomics/windows/netsh_portproxy.ps1
new file mode 100644
index 0000000..1305195
--- /dev/null
+++ b/tests/atomic/atomics/windows/netsh_portproxy.ps1
@@ -0,0 +1,13 @@
+# Atomic test - rule 6c46cc68-2e66-4834-b058-0a2cfd115409
+#   "Netsh Port-Proxy Tunnel Configuration"  (process_creation)
+#
+# Copies cmd.exe to netsh.exe and emits the interface portproxy add command-line
+# shape without configuring any real port forwarding.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-netsh-atomic'
+$bin = Join-Path $dir 'netsh.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+& $bin /c echo interface portproxy add v4tov4 | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/procdump_lsass.ps1 b/tests/atomic/atomics/windows/procdump_lsass.ps1
new file mode 100644
index 0000000..8e86411
--- /dev/null
+++ b/tests/atomic/atomics/windows/procdump_lsass.ps1
@@ -0,0 +1,13 @@
+# Atomic test - rule 04d66f93-97ae-4674-96a8-1bb524a1da60
+#   "LSASS Memory Dump via Procdump"  (process_creation)
+#
+# Copies cmd.exe to procdump.exe and emits the procdump-against-lsass
+# command-line shape without dumping any process memory.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-procdump-atomic'
+$bin = Join-Path $dir 'procdump.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+& $bin /c echo -ma lsass lsass.dmp | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/sc_stop_security.ps1 b/tests/atomic/atomics/windows/sc_stop_security.ps1
new file mode 100644
index 0000000..241aac7
--- /dev/null
+++ b/tests/atomic/atomics/windows/sc_stop_security.ps1
@@ -0,0 +1,13 @@
+# Atomic test - rule 43c59081-d5ec-4153-9e26-04e66e07461a
+#   "Security Service Stop or Disable via sc or net"  (process_creation)
+#
+# Copies cmd.exe to sc.exe and emits a "stop <security service>" command-line
+# shape without touching any real service.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-scstop-atomic'
+$bin = Join-Path $dir 'sc.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+& $bin /c echo stop Sysmon | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/winlogon_helper.ps1 b/tests/atomic/atomics/windows/winlogon_helper.ps1
new file mode 100644
index 0000000..0ea5445
--- /dev/null
+++ b/tests/atomic/atomics/windows/winlogon_helper.ps1
@@ -0,0 +1,14 @@
+# Atomic test - rule 52b94494-756b-40d7-af01-8d0c7d54a6cc
+#   "Winlogon Helper DLL or Shell Modification"  (registry_event)
+#
+# Creates a Winlogon key whose path ends in the watched Shell value name, under
+# HKCU only, then removes it. Registry telemetry exposes the key path but not the
+# value name.
+$ErrorActionPreference = 'SilentlyContinue'
+$base = 'HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon'
+$key = "$base\Shell"
+New-Item -Path $key -Force | Out-Null
+New-ItemProperty -Path $key -Name 'AtomicValue' -Value 'explorer.exe' -PropertyType String -Force | Out-Null
+Start-Sleep -Seconds 1
+Remove-Item $base -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/atomics/windows/xmrig_yara_fixture.ps1 b/tests/atomic/atomics/windows/xmrig_yara_fixture.ps1
new file mode 100644
index 0000000..03cd9a0
--- /dev/null
+++ b/tests/atomic/atomics/windows/xmrig_yara_fixture.ps1
@@ -0,0 +1,14 @@
+# Atomic test - rule yara-win-xmrig-coinminer
+#   "XMRig / coinminer strings in Windows PE binaries"  (yara file_scan)
+#
+# Copies cmd.exe, appends XMRig marker strings as a PE overlay, executes the
+# copy, then removes it. The overlay does not affect execution.
+$ErrorActionPreference = 'SilentlyContinue'
+$dir = Join-Path $env:TEMP 'rustinel-xmrig-atomic'
+$bin = Join-Path $dir 'rustinel_xmrig_fixture.exe'
+New-Item -ItemType Directory -Path $dir -Force | Out-Null
+Copy-Item "$env:SystemRoot\System32\cmd.exe" $bin -Force
+[IO.File]::AppendAllText($bin, "xmrig`nstratum+tcp://`ndonate-level`nrandomx`nmonero`n")
+& $bin /c exit 0 | Out-Null
+Remove-Item $dir -Recurse -Force -ErrorAction SilentlyContinue
+exit 0
diff --git a/tests/atomic/manifest.json b/tests/atomic/manifest.json
index 6f282d4..b02ed20 100644
--- a/tests/atomic/manifest.json
+++ b/tests/atomic/manifest.json
@@ -239,6 +239,146 @@
       "allow_failure": true,
       "expect": { "field": "rule.description", "contains": "EICAR" }
     },
+    {
+      "id": "1adaaaca-bfcf-46fe-9bd1-4b475d7bc827",
+      "name": "linux_nc_exec_reverse_shell",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/nc_exec_reverse_shell.sh"
+    },
+    {
+      "id": "3f32d825-006a-45e9-b5a9-6e7edeeff13c",
+      "name": "linux_kmod_load_susp_path",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/kmod_load_susp_path.sh"
+    },
+    {
+      "id": "66fd4673-d86b-41d1-ba33-60d7c66dc962",
+      "name": "linux_backdoor_account",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/backdoor_account.sh"
+    },
+    {
+      "id": "6b124b53-1d4b-48a2-86b7-4df9bf43de61",
+      "name": "linux_log_clear",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/log_clear.sh"
+    },
+    {
+      "id": "7a34ffc3-adbc-4d9d-94a4-4bd33ac05cc3",
+      "name": "linux_chmod_suid",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/chmod_suid.sh"
+    },
+    {
+      "id": "1bb5e9e4-f17e-476e-8e77-aaa1858f12f7",
+      "name": "linux_udev_persistence",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/udev_persistence.sh"
+    },
+    {
+      "id": "e96a9b85-26f6-4251-a26b-361d4b6761ef",
+      "name": "linux_webshell_write",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/webshell_write.sh"
+    },
+    {
+      "id": "d24c4943-3e22-481f-99ee-ca631b8a77af",
+      "name": "linux_base64_pipe_shell",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/base64_pipe_shell.sh"
+    },
+    {
+      "id": "0cb59840-b420-4332-b7d1-2c3d4343901f",
+      "name": "linux_stop_security_services",
+      "platform": "linux",
+      "engine": "sigma",
+      "script": "linux/stop_security_services.sh"
+    },
+    {
+      "id": "yara-lnx-msfvenom-stager",
+      "name": "linux_msfvenom_yara_fixture",
+      "platform": "linux",
+      "engine": "yara",
+      "script": "linux/msfvenom_yara_fixture.sh"
+    },
+    {
+      "id": "e86de5fe-3908-4a95-b4e8-930a93bf4555",
+      "name": "windows_bcdedit_recovery_tamper",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/bcdedit_recovery_tamper.ps1"
+    },
+    {
+      "id": "596b49d3-561e-49d7-9538-f3115c1c8cfd",
+      "name": "windows_fsutil_usn_delete",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/fsutil_usn_delete.ps1"
+    },
+    {
+      "id": "04d66f93-97ae-4674-96a8-1bb524a1da60",
+      "name": "windows_procdump_lsass",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/procdump_lsass.ps1"
+    },
+    {
+      "id": "cda4a133-fe67-4aa6-815d-f8c69ff16828",
+      "name": "windows_ifeo_debugger",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/ifeo_debugger.ps1"
+    },
+    {
+      "id": "52b94494-756b-40d7-af01-8d0c7d54a6cc",
+      "name": "windows_winlogon_helper",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/winlogon_helper.ps1"
+    },
+    {
+      "id": "43c59081-d5ec-4153-9e26-04e66e07461a",
+      "name": "windows_sc_stop_security",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/sc_stop_security.ps1"
+    },
+    {
+      "id": "6c46cc68-2e66-4834-b058-0a2cfd115409",
+      "name": "windows_netsh_portproxy",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/netsh_portproxy.ps1"
+    },
+    {
+      "id": "d97177dd-c74f-465e-96c1-194cc1dd681d",
+      "name": "windows_bitsadmin_download",
+      "platform": "windows",
+      "engine": "sigma",
+      "script": "windows/bitsadmin_download.ps1"
+    },
+    {
+      "id": "yara-win-xmrig-coinminer",
+      "name": "windows_xmrig_yara_fixture",
+      "platform": "windows",
+      "engine": "yara",
+      "script": "windows/xmrig_yara_fixture.ps1"
+    },
+    {
+      "id": "yara-win-msfvenom-stager",
+      "name": "windows_msfvenom_yara_fixture",
+      "platform": "windows",
+      "engine": "yara",
+      "script": "windows/msfvenom_yara_fixture.ps1"
+    },
     {
       "id": "be06a6b0-fa9f-4df4-9d4a-9f8794037508",
       "name": "macos_reverse_shell_dev_tcp",
diff --git a/tools/attack_techniques.json b/tools/attack_techniques.json
index 2329260..13561fe 100644
--- a/tools/attack_techniques.json
+++ b/tools/attack_techniques.json
@@ -4,7 +4,10 @@
     "T1003.001": { "name": "OS Credential Dumping: LSASS Memory", "tactic": "credential-access" },
     "T1003.002": { "name": "OS Credential Dumping: Security Account Manager", "tactic": "credential-access" },
     "T1003.003": { "name": "OS Credential Dumping: NTDS", "tactic": "credential-access" },
+    "T1005":     { "name": "Data from Local System", "tactic": "collection" },
+    "T1014":     { "name": "Rootkit", "tactic": "defense-evasion" },
     "T1027":     { "name": "Obfuscated Files or Information", "tactic": "defense-evasion" },
+    "T1033":     { "name": "System Owner/User Discovery", "tactic": "discovery" },
     "T1036":     { "name": "Masquerading", "tactic": "defense-evasion" },
     "T1047":     { "name": "Windows Management Instrumentation", "tactic": "execution" },
     "T1053.003": { "name": "Scheduled Task/Job: Cron", "tactic": "execution" },
@@ -14,14 +17,24 @@
     "T1059.001": { "name": "Command and Scripting Interpreter: PowerShell", "tactic": "execution" },
     "T1059.002": { "name": "Command and Scripting Interpreter: AppleScript", "tactic": "execution" },
     "T1059.004": { "name": "Command and Scripting Interpreter: Unix Shell", "tactic": "execution" },
+    "T1069.002": { "name": "Permission Groups Discovery: Domain Groups", "tactic": "discovery" },
+    "T1070":     { "name": "Indicator Removal", "tactic": "defense-evasion" },
     "T1070.001": { "name": "Indicator Removal: Clear Windows Event Logs", "tactic": "defense-evasion" },
+    "T1070.002": { "name": "Indicator Removal: Clear Linux or Mac System Logs", "tactic": "defense-evasion" },
+    "T1070.003": { "name": "Indicator Removal: Clear Command History", "tactic": "defense-evasion" },
+    "T1071":     { "name": "Application Layer Protocol", "tactic": "command-and-control" },
+    "T1090.001": { "name": "Proxy: Internal Proxy", "tactic": "command-and-control" },
     "T1098":     { "name": "Account Manipulation", "tactic": "persistence" },
     "T1098.004": { "name": "Account Manipulation: SSH Authorized Keys", "tactic": "persistence" },
     "T1105":     { "name": "Ingress Tool Transfer", "tactic": "command-and-control" },
     "T1136.001": { "name": "Create Account: Local Account", "tactic": "persistence" },
+    "T1197":     { "name": "BITS Jobs", "tactic": "defense-evasion" },
+    "T1218":     { "name": "System Binary Proxy Execution", "tactic": "defense-evasion" },
     "T1218.005": { "name": "System Binary Proxy Execution: Mshta", "tactic": "defense-evasion" },
     "T1218.010": { "name": "System Binary Proxy Execution: Regsvr32", "tactic": "defense-evasion" },
     "T1218.011": { "name": "System Binary Proxy Execution: Rundll32", "tactic": "defense-evasion" },
+    "T1219":     { "name": "Remote Access Software", "tactic": "command-and-control" },
+    "T1482":     { "name": "Domain Trust Discovery", "tactic": "discovery" },
     "T1490":     { "name": "Inhibit System Recovery", "tactic": "impact" },
     "T1496":     { "name": "Resource Hijacking", "tactic": "impact" },
     "T1505.003": { "name": "Server Software Component: Web Shell", "tactic": "persistence" },
@@ -29,14 +42,24 @@
     "T1543.002": { "name": "Create or Modify System Process: Systemd Service", "tactic": "persistence" },
     "T1543.003": { "name": "Create or Modify System Process: Windows Service", "tactic": "persistence" },
     "T1543.004": { "name": "Create or Modify System Process: Launch Daemon", "tactic": "persistence" },
+    "T1546.003": { "name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription", "tactic": "persistence" },
     "T1546.004": { "name": "Event Triggered Execution: Unix Shell Configuration Modification", "tactic": "persistence" },
+    "T1546.008": { "name": "Event Triggered Execution: Accessibility Features", "tactic": "persistence" },
+    "T1546.012": { "name": "Event Triggered Execution: Image File Execution Options Injection", "tactic": "persistence" },
+    "T1547":     { "name": "Boot or Logon Autostart Execution", "tactic": "persistence" },
     "T1547.001": { "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder", "tactic": "persistence" },
+    "T1547.004": { "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL", "tactic": "persistence" },
+    "T1547.006": { "name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions", "tactic": "persistence" },
+    "T1548":     { "name": "Abuse Elevation Control Mechanism", "tactic": "privilege-escalation" },
+    "T1548.001": { "name": "Abuse Elevation Control Mechanism: Setuid and Setgid", "tactic": "privilege-escalation" },
     "T1548.002": { "name": "Abuse Elevation Control Mechanism: Bypass User Account Control", "tactic": "privilege-escalation" },
     "T1548.003": { "name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching", "tactic": "privilege-escalation" },
     "T1553.001": { "name": "Subvert Trust Controls: Gatekeeper Bypass", "tactic": "defense-evasion" },
     "T1555.001": { "name": "Credentials from Password Stores: Keychain", "tactic": "credential-access" },
+    "T1555.003": { "name": "Credentials from Password Stores: Credentials from Web Browsers", "tactic": "credential-access" },
     "T1562.001": { "name": "Impair Defenses: Disable or Modify Tools", "tactic": "defense-evasion" },
     "T1566.001": { "name": "Phishing: Spearphishing Attachment", "tactic": "initial-access" },
+    "T1574.002": { "name": "Hijack Execution Flow: DLL Side-Loading", "tactic": "defense-evasion" },
     "T1574.006": { "name": "Hijack Execution Flow: Dynamic Linker Hijacking", "tactic": "persistence" }
   }
 }