Sigma detection rules, expert-reviewed

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Detects execution of GoldenDMSA.exe with command-line indicators consistent with wordlist/bruteforce directory account manipulation.

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Alerts on registry modifications under Security Center AV Provider keys that update antivirus product fields like ProductEXE and DisplayName.

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

Detects Defendnot persistence by alerting on scheduled task create/update activity for \defendnot with --from-autorun.

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Alerts when reg.exe modifies Windows policy settings that disable or restrict internal tools and Explorer/System behavior.

Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

Flags registry updates that enable per-application Microsoft Defender Firewall exceptions via AuthorizedApplications\List.

Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)

Alerts when DoNotAllowExceptions is set to 0 in the Defender Firewall policy registry path, re-enabling firewall exceptions.

PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)

Flags PowerShell command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke them via array index.

Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index

Flags obfuscated PowerShell scripts that enumerate ExportedCommands and invoke them indirectly using array indexing.

Windows: Detect Defendnot HackTool Process Execution

Alerts on Windows process executions referencing Defendnot, including its URL and known IMPHASH values.

Uncommon Child Process Spawned by XBootMgrSleep.exe (Windows Performance Toolkit)

Alerts when XBootMgrSleep.exe launches an unexpected child process on Windows, indicating potential delayed execution abuse.

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.

Windows Process: SystemSettingsAdminFlows.exe Used to Disable Windows Defender

Alerts when SystemSettingsAdminFlows.exe is launched with command-line arguments consistent with disabling Windows Defender.

Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.

Windows Process Creation: curl.exe Using NTLM with Empty Username (-u :)

Alerts when curl is run on Windows with --ntlm and empty -u : credentials, a pattern that may leak the current user's NTLMv2 response.