Sigma detection rules, expert-reviewed

Windows Scheduled Task Creation Using System Process Names

Flags schtasks.exe /create commands whose arguments reference common Windows system process names.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows Process Creation: NimScan.exe Execution via Known File Hashes

Alerts on Windows execution of NimScan.exe when process image and known IMPHASH values match.

Windows MMC Executes Files with RLO-Reversed Extensions in Process Command Line

Alerts when mmc.exe runs with command lines containing RLO-style reversed filename patterns ending in .msc.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows MMC Loads Script Engine DLLs (vbscript.dll, jscript.dll, jscript9.dll)

Alerts when mmc.exe loads vbscript/jscript script engine DLLs, which can indicate script execution in a trusted process.

Windows file creation of executable/script files in \Users\Public

Alerts on Windows file creation in \Users\Public\ with potentially malicious script/binary extensions.

Windows: Clfs.sys Loaded from Suspicious Process Image Paths

Alerts when clfs.sys is loaded by a process running from user/temp/perflogs-style suspicious paths on Windows.

Windows Registry EventLog ChannelAccess SDDL Tampering Detection

Detects registry changes to Windows Event Log ChannelAccess SDDL, which can limit event log visibility or control.

Windows Process Creation: Microsoft QuickAssist.exe Execution

Alerts on execution of QuickAssist.exe by matching the process image ending with \QuickAssist.exe.

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Alerts when QuickAssist.exe performs DNS lookups for the Microsoft Quick Assist remote session endpoint.

Windows Setup16.EXE Execution Triggered by Custom .LST File

Flags Windows Setup16.EXE being invoked with ' -m ' from its system parent process, potentially tied to custom .lst-driven execution.

Windows Suspicious ShellExec_RunDLL via SHELL32.DLL Ordinal in Parent Command Line

Alert on Windows process starts where parent command line invokes SHELL32.DLL ShellExec_RunDLL using a matched ordinal and spawns suspicious binaries.

Windows File Event: Detect RTLO Filename Extension Spoofing

Flags Windows filenames containing U+202E plus reversed extension strings that indicate potential extension spoofing.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.