Sigma detection rules, expert-reviewed

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Alerts on WinRAR/RAR process execution when launched from folders outside standard WinRAR installation paths.

Windows ADCS Template Enrollment Supplies Subject and Risky EKU (Event ID 4898/4899)

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

Alerts when Office app processes initiate outbound TCP/HTTP(S)/mail connections to non-private IPs, excluding common private and known provider ranges.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

Windows Process Creation: cscript/wscript Register-App.vbs COM+ Registration

Alert on cscript/wscript running “.vbs -register” to register COM+ components, potentially leveraging register_app.vbs.

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Flags cmdl32.exe executions using /vpn and /lan that may indicate arbitrary file retrieval behavior.

Windows Process Creation: PowerShell ExecutionPolicy Set to Bypass/Unrestricted

Alerts on PowerShell started with -ExecutionPolicy set to Bypass/Unrestricted, indicating a potentially insecure script execution posture.

Windows Process Creation: Command-Line Indicators of Crypto Mining

Alerts on Windows processes with command-line arguments matching common crypto miner pool and configuration indicators.