Sigma detection rules, expert-reviewed

Windows Prefetch File Deletion via .pf File Removal

Flags deletion of .pf files in \\Windows\\Prefetch, a possible attempt to remove execution artifacts.

Windows Process Memory Dump Using RdrLeakDiag.exe (/memdmp|fullmemdmp)

Alerts on Windows executions of rdrleakdiag.exe that request full or targeted memory dumps via /memdmp or /fullmemdmp.

PowerShell Live Memory Dump via Get-StorageDiagnosticInfo with -IncludeLiveDump (Windows)

Identifies PowerShell use of Get-StorageDiagnosticInfo with -IncludeLiveDump to trigger a live memory dump on Windows.

Windows: Xwizard.exe Execution from Non-Default Directory

Alerts when Xwizard.exe starts from an unexpected Windows path, indicating potential misuse or side-loading.

PowerShell Add-DnsClientNrptRule Modifies NRPT Namespaces

Flags PowerShell scripts that add DNS Name Resolution Policy Table rules for a specified namespace.

PowerShell ScriptBlock launching redirected comspec to Alternate Data Stream via '>'

Flags PowerShell script blocks using Start-Process with comspec and " > " redirection consistent with ADS-style file hiding.

Windows Kerberos TGT Request with AD CS Certificate Thumbprint Anomalies (EventID 4768)

Identifies unusual certificate-associated Kerberos TGT (4768) requests targeting computer accounts on Windows.

Windows WMI Event Consumer with Encoded Payload Containing Suspicious Strings

Detects WMI event consumer encoded payloads containing suspicious execution-related strings on Windows.

Windows Process Creation: Execution CommandLines Involving NTFS Alternate Data Streams

Alerts on Windows executions whose command lines reference NTFS Alternate Data Streams combined with specific file-data tools.

Windows WMI Event Consumer (scrcons.exe) Creates Named Pipe

Flags scrcons.exe creating a Windows named pipe, using named pipe creation event telemetry.

Windows Atera RMM Agent Installation via MsiInstaller Event ID 1033

Flags Windows MSI installs where installer logs indicate an AteraAgent installation (EventID 1033, MsiInstaller).

Windows UAC Bypass via ComputerDefaults.exe with Elevated Integrity Parent Process

Flags ComputerDefaults.exe runs at high/system integrity when the parent isn’t from typical system or Program Files paths.

Windows Registry UAC Bypass via winsat.exe LowerCaseLongPath and UACMe Path Parsing

Matches registry writes that reference winsat.exe using a LowerCaseLongPath construction consistent with UAC bypass path parsing.

Windows Process Creation: UAC Bypass via winsat.exe Path Parsing

Alerts on elevated processes spawned by Temp-path winsat.exe with system32 winsat command-line content.

Windows UAC Bypass via NTFS Reparse Point: wusa.exe DLL Hijacking Process Behavior

Alerts on high-integrity wusa.exe launched from Temp update.msu with a dism.exe parent showing DismHost activity.