Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious Command-Line Path Traversal Evasion Strings

Flags Windows command-line strings that look like “..\” path traversal evasion attempts, excluding known Google Drive and Citrix launcher patterns.

Windows Network Connections to Known Crypto Mining Pools

Flags Windows hosts making outbound connections to known cryptocurrency mining pool domains.

Windows Browser Process Creating VHD/VHDX Files via Download

Alerts when a Windows browser process creates files containing .vhd, indicating potential VHD/VHDX staging.

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

Windows: CertOC.exe certificate utility loading a DLL via -LoadDLL

Flags CertOC.exe launching with -LoadDLL to load a specified DLL on Windows.

Windows Process Execution via WorkFolders.exe Launching control.exe

Alerts when WorkFolders.exe spawns a non-standard control.exe instance on Windows.

Windows process execution via stordiag.exe launching schtasks.exe, systeminfo.exe, or fltmc.exe

Detects stordiag.exe spawning schtasks.exe, systeminfo.exe, or fltmc.exe to support system discovery or config actions on Windows.

PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)

Flags PowerShell script block text indicating WindowStyle set to Hidden, suggesting concealed execution.

PowerShell: Set-ExecutionPolicy to Unrestricted or Bypass

Alerts when PowerShell sets execution policy to Unrestricted or bypass, indicating weakened script execution controls.

Windows Registry: Clearing RDP Client Connection History via MRU and Server Keys Deletion

Flags registry deletions that remove Windows RDP client connection history from Terminal Server Client MRU and Servers keys.

Windows PowerShell: Disable Windows Firewall Profile via Set-NetFirewallProfile

Flags PowerShell commands that disable one or more Windows Firewall profiles via Set-NetFirewallProfile -Enabled $false.

Windows vmtoolsd.exe Child Process Spawn via Scripting/Utility Binaries

Alert on vmtoolsd.exe spawning cmd/powershell/mshta/regsvr32/rundll32/wscript child processes with VM Tools batch-script command lines.

Windows Named Pipe Access to ADFS/WID Database by Uncommon Process

Alert on named pipe creation to the AD FS WID SQL query endpoint when initiated by uncommon processes.

Windows: Suspicious Driver Installation via pnputil.exe

Flags pnputil.exe command lines indicating driver install/add actions targeting .inf files on Windows.

Windows DataSvcUtil.exe Command-Line Exfiltration Using /in:, /out:, and /uri:

Alerts on DataSvcUtil.exe runs with /in:, /out:, and /uri: parameters that may indicate data exfiltration activity.